/******************************************************************/
/*                                                                */
/*  Winpooch : Windows Watchdog                                   */
/*  Copyright (C) 2004-2006  Benoit Blanchon                      */
/*                                                                */
/*  This program is free software; you can redistribute it        */
/*  and/or modify it under the terms of the GNU General Public    */
/*  License as published by the Free Software Foundation; either  */
/*  version 2 of the License, or (at your option) any later       */
/*  version.                                                      */
/*                                                                */
/*  This program is distributed in the hope that it will be       */
/*  useful, but WITHOUT ANY WARRANTY; without even the implied    */
/*  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR       */
/*  PURPOSE.  See the GNU General Public License for more         */
/*  details.                                                      */
/*                                                                */
/*  You should have received a copy of the GNU General Public     */
/*  License along with this program; if not, write to the Free    */
/*  Software Foundation, Inc.,                                    */
/*  675 Mass Ave, Cambridge, MA 02139, USA.                       */
/*                                                                */
/******************************************************************/


/******************************************************************/
/* Build configuration                                            */
/******************************************************************/

#define	TRACE_LEVEL	2


/******************************************************************/
/* Includes                                                       */
/******************************************************************/

// module's interface
#define _NTUNDOC_C
#include "NtUndoc.h"

// project's headers
#include "ImgInfo.h"
#include "SystInfo.h"
#include "Trace.h"


/******************************************************************/
/* Exported data                                                  */
/******************************************************************/

NTUNDOC_NAMESPACE ntundoc ;


/******************************************************************/
/* Internal macros                                                */
/******************************************************************/

#define arraysize(a) (sizeof(a)/sizeof((a)[0]))


/******************************************************************/
/* Internal data types                                            */
/******************************************************************/

typedef struct {
  LPCTSTR           szOsVersion ;
  LPCTSTR           szSignature ;
  NTUNDOC_NAMESPACE offsets ;
} NTUNDOC_OSVERSION ;


/******************************************************************/
/* Internal data                                                  */
/******************************************************************/

static NTUNDOC_OSVERSION g_aOsVersion[] = 
  {
    {
      TEXT("ntkrnlpa 5.00.2195.1 (english)"),
      TEXT("384D5A86189840"),
      {
        .NtCreateProcess           = (void*) 0x000DEE96,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C6DCA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFCA6,
        .NtQueryInformationFile    = (void*) 0x000A685A,
        .NtQueryKey                = (void*) 0x0010EB36,
        .NtQueryValueKey           = (void*) 0x0010EDCC,
        .NtSetInformationFile      = (void*) 0x000A6EA8,
        .NtSetValueKey             = (void*) 0x0010F45E,
        .ObpFreeObject             = (void*) 0x000D548E,
        .PspTerminateProcess       = (void*) 0x000DFE28,
        .swprintf                  = (void*) 0x0005EC20,
        .ZwOpenProcess             = (void*) 0x0002E094,
        .ZwProtectVirtualMemory    = (void*) 0x0002E164,
        .ZwReadVirtualMemory       = (void*) 0x0002E434,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.1 (french)"),
      TEXT("384D5A8618A6C0"),
      {
        .NtCreateProcess           = (void*) 0x000DEE96,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C6DCA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFCA6,
        .NtQueryInformationFile    = (void*) 0x000A685A,
        .NtQueryKey                = (void*) 0x0010EB36,
        .NtQueryValueKey           = (void*) 0x0010EDCC,
        .NtSetInformationFile      = (void*) 0x000A6EA8,
        .NtSetValueKey             = (void*) 0x0010F45E,
        .ObpFreeObject             = (void*) 0x000D548E,
        .PspTerminateProcess       = (void*) 0x000DFE28,
        .swprintf                  = (void*) 0x0005EC20,
        .ZwOpenProcess             = (void*) 0x0002E094,
        .ZwProtectVirtualMemory    = (void*) 0x0002E164,
        .ZwReadVirtualMemory       = (void*) 0x0002E434,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.1 (german)"),
      TEXT("384D5A8618A200"),
      {
        .NtCreateProcess           = (void*) 0x000DEE96,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C6DCA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFCA6,
        .NtQueryInformationFile    = (void*) 0x000A685A,
        .NtQueryKey                = (void*) 0x0010EB36,
        .NtQueryValueKey           = (void*) 0x0010EDCC,
        .NtSetInformationFile      = (void*) 0x000A6EA8,
        .NtSetValueKey             = (void*) 0x0010F45E,
        .ObpFreeObject             = (void*) 0x000D548E,
        .PspTerminateProcess       = (void*) 0x000DFE28,
        .swprintf                  = (void*) 0x0005EC20,
        .ZwOpenProcess             = (void*) 0x0002E094,
        .ZwProtectVirtualMemory    = (void*) 0x0002E164,
        .ZwReadVirtualMemory       = (void*) 0x0002E434,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.1 (polish)"),
      TEXT("384D5A86189E80"),
      {
        .NtCreateProcess           = (void*) 0x000DEE96,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C6DCA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFCA6,
        .NtQueryInformationFile    = (void*) 0x000A685A,
        .NtQueryKey                = (void*) 0x0010EB36,
        .NtQueryValueKey           = (void*) 0x0010EDCC,
        .NtSetInformationFile      = (void*) 0x000A6EA8,
        .NtSetValueKey             = (void*) 0x0010F45E,
        .ObpFreeObject             = (void*) 0x000D548E,
        .PspTerminateProcess       = (void*) 0x000DFE28,
        .swprintf                  = (void*) 0x0005EC20,
        .ZwOpenProcess             = (void*) 0x0002E094,
        .ZwProtectVirtualMemory    = (void*) 0x0002E164,
        .ZwReadVirtualMemory       = (void*) 0x0002E434,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.1 (english)"),
      TEXT("384D9B17190900"),
      {
        .NtCreateProcess           = (void*) 0x000AD948,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000AEFF6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A2FAC,
        .NtQueryInformationFile    = (void*) 0x000AE525,
        .NtQueryKey                = (void*) 0x0009923A,
        .NtQueryValueKey           = (void*) 0x0009A077,
        .NtSetInformationFile      = (void*) 0x000C1308,
        .NtSetValueKey             = (void*) 0x000B8D90,
        .ObpFreeObject             = (void*) 0x00095B7F,
        .PspTerminateProcess       = (void*) 0x000FB3EB,
        .swprintf                  = (void*) 0x0005DEE2,
        .ZwOpenProcess             = (void*) 0x00000E5A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F2A,
        .ZwReadVirtualMemory       = (void*) 0x000011FA,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.1 (french)"),
      TEXT("384D9B17191780"),
      {
        .NtCreateProcess           = (void*) 0x000AD948,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000AEFF6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A2FAC,
        .NtQueryInformationFile    = (void*) 0x000AE525,
        .NtQueryKey                = (void*) 0x0009923A,
        .NtQueryValueKey           = (void*) 0x0009A077,
        .NtSetInformationFile      = (void*) 0x000C1308,
        .NtSetValueKey             = (void*) 0x000B8D90,
        .ObpFreeObject             = (void*) 0x00095B7F,
        .PspTerminateProcess       = (void*) 0x000FB3EB,
        .swprintf                  = (void*) 0x0005DEE2,
        .ZwOpenProcess             = (void*) 0x00000E5A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F2A,
        .ZwReadVirtualMemory       = (void*) 0x000011FA,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.1 (german)"),
      TEXT("384D9B171912C0"),
      {
        .NtCreateProcess           = (void*) 0x000AD948,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000AEFF6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A2FAC,
        .NtQueryInformationFile    = (void*) 0x000AE525,
        .NtQueryKey                = (void*) 0x0009923A,
        .NtQueryValueKey           = (void*) 0x0009A077,
        .NtSetInformationFile      = (void*) 0x000C1308,
        .NtSetValueKey             = (void*) 0x000B8D90,
        .ObpFreeObject             = (void*) 0x00095B7F,
        .PspTerminateProcess       = (void*) 0x000FB3EB,
        .swprintf                  = (void*) 0x0005DEE2,
        .ZwOpenProcess             = (void*) 0x00000E5A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F2A,
        .ZwReadVirtualMemory       = (void*) 0x000011FA,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.1 (polish)"),
      TEXT("384D9B17190F40"),
      {
        .NtCreateProcess           = (void*) 0x000AD948,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000AEFF6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A2FAC,
        .NtQueryInformationFile    = (void*) 0x000AE525,
        .NtQueryKey                = (void*) 0x0009923A,
        .NtQueryValueKey           = (void*) 0x0009A077,
        .NtSetInformationFile      = (void*) 0x000C1308,
        .NtSetValueKey             = (void*) 0x000B8D90,
        .ObpFreeObject             = (void*) 0x00095B7F,
        .PspTerminateProcess       = (void*) 0x000FB3EB,
        .swprintf                  = (void*) 0x0005DEE2,
        .ZwOpenProcess             = (void*) 0x00000E5A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F2A,
        .ZwReadVirtualMemory       = (void*) 0x000011FA,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.2951 (french)"),
      TEXT("3AD7789119C400"),
      {
        .NtCreateProcess           = (void*) 0x000E21B4,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C9C98,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E2FC4,
        .NtQueryInformationFile    = (void*) 0x000A9C96,
        .NtQueryKey                = (void*) 0x00112128,
        .NtQueryValueKey           = (void*) 0x001123BE,
        .NtSetInformationFile      = (void*) 0x000AA2E4,
        .NtSetValueKey             = (void*) 0x00112A50,
        .ObpFreeObject             = (void*) 0x000D873C,
        .PspTerminateProcess       = (void*) 0x000E3146,
        .swprintf                  = (void*) 0x00061B80,
        .ZwOpenProcess             = (void*) 0x0002E4B0,
        .ZwProtectVirtualMemory    = (void*) 0x0002E580,
        .ZwReadVirtualMemory       = (void*) 0x0002E850,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.2951 (french)"),
      TEXT("3AD7AD601A3280"),
      {
        .NtCreateProcess           = (void*) 0x000C2408,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000A6966,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000C2D5E,
        .NtQueryInformationFile    = (void*) 0x000A5BA9,
        .NtQueryKey                = (void*) 0x000A73C5,
        .NtQueryValueKey           = (void*) 0x000A3DDA,
        .NtSetInformationFile      = (void*) 0x0009E4B6,
        .NtSetValueKey             = (void*) 0x000A7B60,
        .ObpFreeObject             = (void*) 0x0009CB89,
        .PspTerminateProcess       = (void*) 0x000FDBAF,
        .swprintf                  = (void*) 0x00061112,
        .ZwOpenProcess             = (void*) 0x00000E9A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F6A,
        .ZwReadVirtualMemory       = (void*) 0x0000123A,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.5438 (german)"),
      TEXT("3D362A9019C800"),
      {
        .NtCreateProcess           = (void*) 0x000E28CC,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CA1B0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E36C8,
        .NtQueryInformationFile    = (void*) 0x000AA122,
        .NtQueryKey                = (void*) 0x001128C0,
        .NtQueryValueKey           = (void*) 0x00112B56,
        .NtSetInformationFile      = (void*) 0x000AA770,
        .NtSetValueKey             = (void*) 0x001131E8,
        .ObpFreeObject             = (void*) 0x000D8C80,
        .PspTerminateProcess       = (void*) 0x000E384A,
        .swprintf                  = (void*) 0x00062250,
        .ZwOpenProcess             = (void*) 0x0002E708,
        .ZwProtectVirtualMemory    = (void*) 0x0002E7D8,
        .ZwReadVirtualMemory       = (void*) 0x0002EAA8,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.5438 (polish)"),
      TEXT("3D362A9019C580"),
      {
        .NtCreateProcess           = (void*) 0x000E28CC,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CA1B0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E36C8,
        .NtQueryInformationFile    = (void*) 0x000AA122,
        .NtQueryKey                = (void*) 0x001128C0,
        .NtQueryValueKey           = (void*) 0x00112B56,
        .NtSetInformationFile      = (void*) 0x000AA770,
        .NtSetValueKey             = (void*) 0x001131E8,
        .ObpFreeObject             = (void*) 0x000D8C80,
        .PspTerminateProcess       = (void*) 0x000E384A,
        .swprintf                  = (void*) 0x00062250,
        .ZwOpenProcess             = (void*) 0x0002E708,
        .ZwProtectVirtualMemory    = (void*) 0x0002E7D8,
        .ZwReadVirtualMemory       = (void*) 0x0002EAA8,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.5438 (russian)"),
      TEXT("3D362A9019BF40"),
      {
        .NtCreateProcess           = (void*) 0x000E28CC,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CA1B0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E36C8,
        .NtQueryInformationFile    = (void*) 0x000AA122,
        .NtQueryKey                = (void*) 0x001128C0,
        .NtQueryValueKey           = (void*) 0x00112B56,
        .NtSetInformationFile      = (void*) 0x000AA770,
        .NtSetValueKey             = (void*) 0x001131E8,
        .ObpFreeObject             = (void*) 0x000D8C80,
        .PspTerminateProcess       = (void*) 0x000E384A,
        .swprintf                  = (void*) 0x00062250,
        .ZwOpenProcess             = (void*) 0x0002E708,
        .ZwProtectVirtualMemory    = (void*) 0x0002E7D8,
        .ZwReadVirtualMemory       = (void*) 0x0002EAA8,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.5438 (german)"),
      TEXT("3D366B8B1A2A00"),
      {
        .NtCreateProcess           = (void*) 0x000A8780,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009EB93,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A8FE0,
        .NtQueryInformationFile    = (void*) 0x00098669,
        .NtQueryKey                = (void*) 0x000B37F1,
        .NtQueryValueKey           = (void*) 0x000B3969,
        .NtSetInformationFile      = (void*) 0x00098ACF,
        .NtSetValueKey             = (void*) 0x000B3B25,
        .ObpFreeObject             = (void*) 0x000A5BD8,
        .PspTerminateProcess       = (void*) 0x000FE877,
        .swprintf                  = (void*) 0x00061842,
        .ZwOpenProcess             = (void*) 0x00000E9A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F6A,
        .ZwReadVirtualMemory       = (void*) 0x0000123A,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.5438 (polish)"),
      TEXT("3D366B8B1A2780"),
      {
        .NtCreateProcess           = (void*) 0x000A8780,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009EB93,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A8FE0,
        .NtQueryInformationFile    = (void*) 0x00098669,
        .NtQueryKey                = (void*) 0x000B37F1,
        .NtQueryValueKey           = (void*) 0x000B3969,
        .NtSetInformationFile      = (void*) 0x00098ACF,
        .NtSetValueKey             = (void*) 0x000B3B25,
        .ObpFreeObject             = (void*) 0x000A5BD8,
        .PspTerminateProcess       = (void*) 0x000FE877,
        .swprintf                  = (void*) 0x00061842,
        .ZwOpenProcess             = (void*) 0x00000E9A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F6A,
        .ZwReadVirtualMemory       = (void*) 0x0000123A,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.5438 (russian)"),
      TEXT("3D366B8B1A2140"),
      {
        .NtCreateProcess           = (void*) 0x000A8780,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009EB93,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A8FE0,
        .NtQueryInformationFile    = (void*) 0x00098669,
        .NtQueryKey                = (void*) 0x000B37F1,
        .NtQueryValueKey           = (void*) 0x000B3969,
        .NtSetInformationFile      = (void*) 0x00098ACF,
        .NtSetValueKey             = (void*) 0x000B3B25,
        .ObpFreeObject             = (void*) 0x000A5BD8,
        .PspTerminateProcess       = (void*) 0x000FE877,
        .swprintf                  = (void*) 0x00061842,
        .ZwOpenProcess             = (void*) 0x00000E9A,
        .ZwProtectVirtualMemory    = (void*) 0x00000F6A,
        .ZwReadVirtualMemory       = (void*) 0x0000123A,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.6717 (english)"),
      TEXT("3EE650CD1A2B40"),
      {
        .NtCreateProcess           = (void*) 0x000E6BCA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CE0EA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C34,
        .NtQueryInformationFile    = (void*) 0x000AE056,
        .NtQueryKey                = (void*) 0x00117624,
        .NtQueryValueKey           = (void*) 0x001178BA,
        .NtSetInformationFile      = (void*) 0x000AE6A0,
        .NtSetValueKey             = (void*) 0x00117F4C,
        .ObpFreeObject             = (void*) 0x000DCC3C,
        .PspTerminateProcess       = (void*) 0x000E7DB6,
        .swprintf                  = (void*) 0x00064F90,
        .ZwOpenProcess             = (void*) 0x00030554,
        .ZwProtectVirtualMemory    = (void*) 0x00030624,
        .ZwReadVirtualMemory       = (void*) 0x000308F4,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.6717 (french)"),
      TEXT("3EE650CD1A3900"),
      {
        .NtCreateProcess           = (void*) 0x000E6BCA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CE0EA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C34,
        .NtQueryInformationFile    = (void*) 0x000AE056,
        .NtQueryKey                = (void*) 0x00117624,
        .NtQueryValueKey           = (void*) 0x001178BA,
        .NtSetInformationFile      = (void*) 0x000AE6A0,
        .NtSetValueKey             = (void*) 0x00117F4C,
        .ObpFreeObject             = (void*) 0x000DCC3C,
        .PspTerminateProcess       = (void*) 0x000E7DB6,
        .swprintf                  = (void*) 0x00064F90,
        .ZwOpenProcess             = (void*) 0x00030554,
        .ZwProtectVirtualMemory    = (void*) 0x00030624,
        .ZwReadVirtualMemory       = (void*) 0x000308F4,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.6717 (italian)"),
      TEXT("3EE650CD1C82C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6BCA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CE0EA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C34,
        .NtQueryInformationFile    = (void*) 0x000AE056,
        .NtQueryKey                = (void*) 0x00117624,
        .NtQueryValueKey           = (void*) 0x001178BA,
        .NtSetInformationFile      = (void*) 0x000AE6A0,
        .NtSetValueKey             = (void*) 0x00117F4C,
        .ObpFreeObject             = (void*) 0x000DCC3C,
        .PspTerminateProcess       = (void*) 0x000E7DB6,
        .swprintf                  = (void*) 0x00064F90,
        .ZwOpenProcess             = (void*) 0x00030554,
        .ZwProtectVirtualMemory    = (void*) 0x00030624,
        .ZwReadVirtualMemory       = (void*) 0x000308F4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6717"),
      TEXT("3EE650C919E740"),
      {
        .NtCreateProcess           = (void*) 0x000E29A6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C9F3E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3A0E,
        .NtQueryInformationFile    = (void*) 0x000A9DD6,
        .NtQueryKey                = (void*) 0x001133AC,
        .NtQueryValueKey           = (void*) 0x00113642,
        .NtSetInformationFile      = (void*) 0x000AA424,
        .NtSetValueKey             = (void*) 0x00113CD4,
        .ObpFreeObject             = (void*) 0x000D8A1E,
        .PspTerminateProcess       = (void*) 0x000E3B90,
        .swprintf                  = (void*) 0x00062890,
        .ZwOpenProcess             = (void*) 0x0002EA60,
        .ZwProtectVirtualMemory    = (void*) 0x0002EB30,
        .ZwReadVirtualMemory       = (void*) 0x0002EE00,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6717 (english)"),
      TEXT("3EE650C919D980"),
      {
        .NtCreateProcess           = (void*) 0x000E29A6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C9F3E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3A0E,
        .NtQueryInformationFile    = (void*) 0x000A9DD6,
        .NtQueryKey                = (void*) 0x001133AC,
        .NtQueryValueKey           = (void*) 0x00113642,
        .NtSetInformationFile      = (void*) 0x000AA424,
        .NtSetValueKey             = (void*) 0x00113CD4,
        .ObpFreeObject             = (void*) 0x000D8A1E,
        .PspTerminateProcess       = (void*) 0x000E3B90,
        .swprintf                  = (void*) 0x00062890,
        .ZwOpenProcess             = (void*) 0x0002EA60,
        .ZwProtectVirtualMemory    = (void*) 0x0002EB30,
        .ZwReadVirtualMemory       = (void*) 0x0002EE00,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6717 (german)"),
      TEXT("3EE650C919E240"),
      {
        .NtCreateProcess           = (void*) 0x000E29A6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C9F3E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3A0E,
        .NtQueryInformationFile    = (void*) 0x000A9DD6,
        .NtQueryKey                = (void*) 0x001133AC,
        .NtQueryValueKey           = (void*) 0x00113642,
        .NtSetInformationFile      = (void*) 0x000AA424,
        .NtSetValueKey             = (void*) 0x00113CD4,
        .ObpFreeObject             = (void*) 0x000D8A1E,
        .PspTerminateProcess       = (void*) 0x000E3B90,
        .swprintf                  = (void*) 0x00062890,
        .ZwOpenProcess             = (void*) 0x0002EA60,
        .ZwProtectVirtualMemory    = (void*) 0x0002EB30,
        .ZwReadVirtualMemory       = (void*) 0x0002EE00,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6717"),
      TEXT("3EE6C0021A47C0"),
      {
        .NtCreateProcess           = (void*) 0x000A9212,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009F7F1,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A9BF3,
        .NtQueryInformationFile    = (void*) 0x000987C1,
        .NtQueryKey                = (void*) 0x000B2FC0,
        .NtQueryValueKey           = (void*) 0x000B3138,
        .NtSetInformationFile      = (void*) 0x00098C08,
        .NtSetValueKey             = (void*) 0x000B32F4,
        .ObpFreeObject             = (void*) 0x000A6852,
        .PspTerminateProcess       = (void*) 0x000FBDBA,
        .swprintf                  = (void*) 0x00061E42,
        .ZwOpenProcess             = (void*) 0x00000EDA,
        .ZwProtectVirtualMemory    = (void*) 0x00000FAA,
        .ZwReadVirtualMemory       = (void*) 0x0000127A,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6717 (english)"),
      TEXT("3EE6C0021A3A00"),
      {
        .NtCreateProcess           = (void*) 0x000A9212,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009F7F1,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A9BF3,
        .NtQueryInformationFile    = (void*) 0x000987C1,
        .NtQueryKey                = (void*) 0x000B2FC0,
        .NtQueryValueKey           = (void*) 0x000B3138,
        .NtSetInformationFile      = (void*) 0x00098C08,
        .NtSetValueKey             = (void*) 0x000B32F4,
        .ObpFreeObject             = (void*) 0x000A6852,
        .PspTerminateProcess       = (void*) 0x000FBDBA,
        .swprintf                  = (void*) 0x00061E42,
        .ZwOpenProcess             = (void*) 0x00000EDA,
        .ZwProtectVirtualMemory    = (void*) 0x00000FAA,
        .ZwReadVirtualMemory       = (void*) 0x0000127A,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6717 (german)"),
      TEXT("3EE6C0021A42C0"),
      {
        .NtCreateProcess           = (void*) 0x000A9212,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x0009F7F1,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A9BF3,
        .NtQueryInformationFile    = (void*) 0x000987C1,
        .NtQueryKey                = (void*) 0x000B2FC0,
        .NtQueryValueKey           = (void*) 0x000B3138,
        .NtSetInformationFile      = (void*) 0x00098C08,
        .NtSetValueKey             = (void*) 0x000B32F4,
        .ObpFreeObject             = (void*) 0x000A6852,
        .PspTerminateProcess       = (void*) 0x000FBDBA,
        .swprintf                  = (void*) 0x00061E42,
        .ZwOpenProcess             = (void*) 0x00000EDA,
        .ZwProtectVirtualMemory    = (void*) 0x00000FAA,
        .ZwReadVirtualMemory       = (void*) 0x0000127A,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.6717 (english)"),
      TEXT("3EE650B319DD00"),
      {
        .NtCreateProcess           = (void*) 0x000E3244,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAC68,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E42AE,
        .NtQueryInformationFile    = (void*) 0x000AAC96,
        .NtQueryKey                = (void*) 0x00113C98,
        .NtQueryValueKey           = (void*) 0x00113F2E,
        .NtSetInformationFile      = (void*) 0x000AB2E0,
        .NtSetValueKey             = (void*) 0x001145C0,
        .ObpFreeObject             = (void*) 0x000D92BE,
        .PspTerminateProcess       = (void*) 0x000E4430,
        .swprintf                  = (void*) 0x00062330,
        .ZwOpenProcess             = (void*) 0x00030408,
        .ZwProtectVirtualMemory    = (void*) 0x000304D8,
        .ZwReadVirtualMemory       = (void*) 0x000307A8,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.6717 (french)"),
      TEXT("3EE650B319EAC0"),
      {
        .NtCreateProcess           = (void*) 0x000E3244,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAC68,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E42AE,
        .NtQueryInformationFile    = (void*) 0x000AAC96,
        .NtQueryKey                = (void*) 0x00113C98,
        .NtQueryValueKey           = (void*) 0x00113F2E,
        .NtSetInformationFile      = (void*) 0x000AB2E0,
        .NtSetValueKey             = (void*) 0x001145C0,
        .ObpFreeObject             = (void*) 0x000D92BE,
        .PspTerminateProcess       = (void*) 0x000E4430,
        .swprintf                  = (void*) 0x00062330,
        .ZwOpenProcess             = (void*) 0x00030408,
        .ZwProtectVirtualMemory    = (void*) 0x000304D8,
        .ZwReadVirtualMemory       = (void*) 0x000307A8,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.6717 (italian)"),
      TEXT("3EE650B31C3480"),
      {
        .NtCreateProcess           = (void*) 0x000E3244,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAC68,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E42AE,
        .NtQueryInformationFile    = (void*) 0x000AAC96,
        .NtQueryKey                = (void*) 0x00113C98,
        .NtQueryValueKey           = (void*) 0x00113F2E,
        .NtSetInformationFile      = (void*) 0x000AB2E0,
        .NtSetValueKey             = (void*) 0x001145C0,
        .ObpFreeObject             = (void*) 0x000D92BE,
        .PspTerminateProcess       = (void*) 0x000E4430,
        .swprintf                  = (void*) 0x00062330,
        .ZwOpenProcess             = (void*) 0x00030408,
        .ZwProtectVirtualMemory    = (void*) 0x000304D8,
        .ZwReadVirtualMemory       = (void*) 0x000307A8,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.6902 (german)"),
      TEXT("403D35F91A47C0"),
      {
        .NtCreateProcess           = (void*) 0x000E7A58,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D0084,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E8AC2,
        .NtQueryInformationFile    = (void*) 0x000AE91A,
        .NtQueryKey                = (void*) 0x0011843C,
        .NtQueryValueKey           = (void*) 0x001186D2,
        .NtSetInformationFile      = (void*) 0x000AEF92,
        .NtSetValueKey             = (void*) 0x00118D64,
        .ObpFreeObject             = (void*) 0x000DDAB0,
        .PspTerminateProcess       = (void*) 0x000E8C44,
        .swprintf                  = (void*) 0x000654C0,
        .ZwOpenProcess             = (void*) 0x00030654,
        .ZwProtectVirtualMemory    = (void*) 0x00030724,
        .ZwReadVirtualMemory       = (void*) 0x000309F4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6902 (english)"),
      TEXT("403D35F819EDC0"),
      {
        .NtCreateProcess           = (void*) 0x000E38EE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CBF98,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4956,
        .NtQueryInformationFile    = (void*) 0x000AA790,
        .NtQueryKey                = (void*) 0x00114296,
        .NtQueryValueKey           = (void*) 0x0011452C,
        .NtSetInformationFile      = (void*) 0x000AAE16,
        .NtSetValueKey             = (void*) 0x00114BBE,
        .ObpFreeObject             = (void*) 0x000D9956,
        .PspTerminateProcess       = (void*) 0x000E4AD8,
        .swprintf                  = (void*) 0x00062E10,
        .ZwOpenProcess             = (void*) 0x0002EB70,
        .ZwProtectVirtualMemory    = (void*) 0x0002EC40,
        .ZwReadVirtualMemory       = (void*) 0x0002EF10,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6902 (german)"),
      TEXT("403D35F819F680"),
      {
        .NtCreateProcess           = (void*) 0x000E38EE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CBF98,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4956,
        .NtQueryInformationFile    = (void*) 0x000AA790,
        .NtQueryKey                = (void*) 0x00114296,
        .NtQueryValueKey           = (void*) 0x0011452C,
        .NtSetInformationFile      = (void*) 0x000AAE16,
        .NtSetValueKey             = (void*) 0x00114BBE,
        .ObpFreeObject             = (void*) 0x000D9956,
        .PspTerminateProcess       = (void*) 0x000E4AD8,
        .swprintf                  = (void*) 0x00062E10,
        .ZwOpenProcess             = (void*) 0x0002EB70,
        .ZwProtectVirtualMemory    = (void*) 0x0002EC40,
        .ZwReadVirtualMemory       = (void*) 0x0002EF10,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6902 (?)"),
      TEXT("4047DB831A59C0"),
      {
        .NtCreateProcess           = (void*) 0x000BA844,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000A49AE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000BCA6F,
        .NtQueryInformationFile    = (void*) 0x0009C252,
        .NtQueryKey                = (void*) 0x0009857B,
        .NtQueryValueKey           = (void*) 0x00098256,
        .NtSetInformationFile      = (void*) 0x000999B7,
        .NtSetValueKey             = (void*) 0x000A7DF1,
        .ObpFreeObject             = (void*) 0x00094E14,
        .PspTerminateProcess       = (void*) 0x000FC759,
        .swprintf                  = (void*) 0x00062342,
        .ZwOpenProcess             = (void*) 0x00000ED2,
        .ZwProtectVirtualMemory    = (void*) 0x00000FA2,
        .ZwReadVirtualMemory       = (void*) 0x00001272,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6902 (english)"),
      TEXT("4047DB831A5540"),
      {
        .NtCreateProcess           = (void*) 0x000BA844,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000A49AE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000BCA6F,
        .NtQueryInformationFile    = (void*) 0x0009C252,
        .NtQueryKey                = (void*) 0x0009857B,
        .NtQueryValueKey           = (void*) 0x00098256,
        .NtSetInformationFile      = (void*) 0x000999B7,
        .NtSetValueKey             = (void*) 0x000A7DF1,
        .ObpFreeObject             = (void*) 0x00094E14,
        .PspTerminateProcess       = (void*) 0x000FC759,
        .swprintf                  = (void*) 0x00062342,
        .ZwOpenProcess             = (void*) 0x00000ED2,
        .ZwProtectVirtualMemory    = (void*) 0x00000FA2,
        .ZwReadVirtualMemory       = (void*) 0x00001272,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6902 (german)"),
      TEXT("4047DB831A5E00"),
      {
        .NtCreateProcess           = (void*) 0x000BA844,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000A49AE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000BCA6F,
        .NtQueryInformationFile    = (void*) 0x0009C252,
        .NtQueryKey                = (void*) 0x0009857B,
        .NtQueryValueKey           = (void*) 0x00098256,
        .NtSetInformationFile      = (void*) 0x000999B7,
        .NtSetValueKey             = (void*) 0x000A7DF1,
        .ObpFreeObject             = (void*) 0x00094E14,
        .PspTerminateProcess       = (void*) 0x000FC759,
        .swprintf                  = (void*) 0x00062342,
        .ZwOpenProcess             = (void*) 0x00000ED2,
        .ZwProtectVirtualMemory    = (void*) 0x00000FA2,
        .ZwReadVirtualMemory       = (void*) 0x00001272,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.6902 (german)"),
      TEXT("403D35E219F900"),
      {
        .NtCreateProcess           = (void*) 0x000E40C8,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CCC10,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E5132,
        .NtQueryInformationFile    = (void*) 0x000AB5DA,
        .NtQueryKey                = (void*) 0x00114AB8,
        .NtQueryValueKey           = (void*) 0x00114D4E,
        .NtSetInformationFile      = (void*) 0x000ABC52,
        .NtSetValueKey             = (void*) 0x001153E0,
        .ObpFreeObject             = (void*) 0x000DA128,
        .PspTerminateProcess       = (void*) 0x000E52B4,
        .swprintf                  = (void*) 0x00062840,
        .ZwOpenProcess             = (void*) 0x000304F4,
        .ZwProtectVirtualMemory    = (void*) 0x000305C4,
        .ZwReadVirtualMemory       = (void*) 0x00030894,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6952 (english)"),
      TEXT("40D1D1AD19FF40"),
      {
        .NtCreateProcess           = (void*) 0x000E3B26,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CC040,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4B8E,
        .NtQueryInformationFile    = (void*) 0x000AA838,
        .NtQueryKey                = (void*) 0x00114F1E,
        .NtQueryValueKey           = (void*) 0x001151B4,
        .NtSetInformationFile      = (void*) 0x000AAEBE,
        .NtSetValueKey             = (void*) 0x00115846,
        .ObpFreeObject             = (void*) 0x000D9A70,
        .PspTerminateProcess       = (void*) 0x000E4D10,
        .swprintf                  = (void*) 0x00063500,
        .ZwOpenProcess             = (void*) 0x0002EE2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002EEFC,
        .ZwReadVirtualMemory       = (void*) 0x0002F1CC,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6952 (italian)"),
      TEXT("40D1D1AD1C56C0"),
      {
        .NtCreateProcess           = (void*) 0x000E3B26,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CC040,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4B8E,
        .NtQueryInformationFile    = (void*) 0x000AA838,
        .NtQueryKey                = (void*) 0x00114F1E,
        .NtQueryValueKey           = (void*) 0x001151B4,
        .NtSetInformationFile      = (void*) 0x000AAEBE,
        .NtSetValueKey             = (void*) 0x00115846,
        .ObpFreeObject             = (void*) 0x000D9A70,
        .PspTerminateProcess       = (void*) 0x000E4D10,
        .swprintf                  = (void*) 0x00063500,
        .ZwOpenProcess             = (void*) 0x0002EE2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002EEFC,
        .ZwReadVirtualMemory       = (void*) 0x0002F1CC,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6952 (english)"),
      TEXT("40D1D18319A640"),
      {
        .NtCreateProcess           = (void*) 0x000DF9E2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C8488,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0A4A,
        .NtQueryInformationFile    = (void*) 0x000A6DF8,
        .NtQueryKey                = (void*) 0x00110DD4,
        .NtQueryValueKey           = (void*) 0x0011106A,
        .NtSetInformationFile      = (void*) 0x000A747E,
        .NtSetValueKey             = (void*) 0x001116FC,
        .ObpFreeObject             = (void*) 0x000D5934,
        .PspTerminateProcess       = (void*) 0x000E0BCC,
        .swprintf                  = (void*) 0x00060250,
        .ZwOpenProcess             = (void*) 0x0002EDDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002EEAC,
        .ZwReadVirtualMemory       = (void*) 0x0002F17C,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6952 (italian)"),
      TEXT("40D1D1831BFDC0"),
      {
        .NtCreateProcess           = (void*) 0x000DF9E2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C8488,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0A4A,
        .NtQueryInformationFile    = (void*) 0x000A6DF8,
        .NtQueryKey                = (void*) 0x00110DD4,
        .NtQueryValueKey           = (void*) 0x0011106A,
        .NtSetInformationFile      = (void*) 0x000A747E,
        .NtSetValueKey             = (void*) 0x001116FC,
        .ObpFreeObject             = (void*) 0x000D5934,
        .PspTerminateProcess       = (void*) 0x000E0BCC,
        .swprintf                  = (void*) 0x00060250,
        .ZwOpenProcess             = (void*) 0x0002EDDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002EEAC,
        .ZwReadVirtualMemory       = (void*) 0x0002F17C,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6992 (english)"),
      TEXT("4177334C1A0180"),
      {
        .NtCreateProcess           = (void*) 0x000E3EC6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CC3BE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4F2E,
        .NtQueryInformationFile    = (void*) 0x000AAA38,
        .NtQueryKey                = (void*) 0x001152CE,
        .NtQueryValueKey           = (void*) 0x00115564,
        .NtSetInformationFile      = (void*) 0x000AB0BE,
        .NtSetValueKey             = (void*) 0x00115BF6,
        .ObpFreeObject             = (void*) 0x000D9E18,
        .PspTerminateProcess       = (void*) 0x000E50B0,
        .swprintf                  = (void*) 0x000636E0,
        .ZwOpenProcess             = (void*) 0x0002EFFC,
        .ZwProtectVirtualMemory    = (void*) 0x0002F0CC,
        .ZwReadVirtualMemory       = (void*) 0x0002F39C,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6992 (italian)"),
      TEXT("4177334C1C5900"),
      {
        .NtCreateProcess           = (void*) 0x000E3EC6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CC3BE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4F2E,
        .NtQueryInformationFile    = (void*) 0x000AAA38,
        .NtQueryKey                = (void*) 0x001152CE,
        .NtQueryValueKey           = (void*) 0x00115564,
        .NtSetInformationFile      = (void*) 0x000AB0BE,
        .NtSetValueKey             = (void*) 0x00115BF6,
        .ObpFreeObject             = (void*) 0x000D9E18,
        .PspTerminateProcess       = (void*) 0x000E50B0,
        .swprintf                  = (void*) 0x000636E0,
        .ZwOpenProcess             = (void*) 0x0002EFFC,
        .ZwProtectVirtualMemory    = (void*) 0x0002F0CC,
        .ZwReadVirtualMemory       = (void*) 0x0002F39C,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.6992 (spanish)"),
      TEXT("4177334C1A15C0"),
      {
        .NtCreateProcess           = (void*) 0x000E3EC6,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CC3BE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E4F2E,
        .NtQueryInformationFile    = (void*) 0x000AAA38,
        .NtQueryKey                = (void*) 0x001152CE,
        .NtQueryValueKey           = (void*) 0x00115564,
        .NtSetInformationFile      = (void*) 0x000AB0BE,
        .NtSetValueKey             = (void*) 0x00115BF6,
        .ObpFreeObject             = (void*) 0x000D9E18,
        .PspTerminateProcess       = (void*) 0x000E50B0,
        .swprintf                  = (void*) 0x000636E0,
        .ZwOpenProcess             = (void*) 0x0002EFFC,
        .ZwProtectVirtualMemory    = (void*) 0x0002F0CC,
        .ZwReadVirtualMemory       = (void*) 0x0002F39C,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6992 (english)"),
      TEXT("4177333519A800"),
      {
        .NtCreateProcess           = (void*) 0x000DFD34,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C87B8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0D9C,
        .NtQueryInformationFile    = (void*) 0x000A6FB8,
        .NtQueryKey                = (void*) 0x0011113C,
        .NtQueryValueKey           = (void*) 0x001113D2,
        .NtSetInformationFile      = (void*) 0x000A763E,
        .NtSetValueKey             = (void*) 0x00111A64,
        .ObpFreeObject             = (void*) 0x000D5C86,
        .PspTerminateProcess       = (void*) 0x000E0F1E,
        .swprintf                  = (void*) 0x00060420,
        .ZwOpenProcess             = (void*) 0x0002EFB8,
        .ZwProtectVirtualMemory    = (void*) 0x0002F088,
        .ZwReadVirtualMemory       = (void*) 0x0002F358,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6992 (italian)"),
      TEXT("417733351BFF80"),
      {
        .NtCreateProcess           = (void*) 0x000DFD34,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C87B8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0D9C,
        .NtQueryInformationFile    = (void*) 0x000A6FB8,
        .NtQueryKey                = (void*) 0x0011113C,
        .NtQueryValueKey           = (void*) 0x001113D2,
        .NtSetInformationFile      = (void*) 0x000A763E,
        .NtSetValueKey             = (void*) 0x00111A64,
        .ObpFreeObject             = (void*) 0x000D5C86,
        .PspTerminateProcess       = (void*) 0x000E0F1E,
        .swprintf                  = (void*) 0x00060420,
        .ZwOpenProcess             = (void*) 0x0002EFB8,
        .ZwProtectVirtualMemory    = (void*) 0x0002F088,
        .ZwReadVirtualMemory       = (void*) 0x0002F358,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.6992 (spanish)"),
      TEXT("4177333519BC40"),
      {
        .NtCreateProcess           = (void*) 0x000DFD34,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000C87B8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0D9C,
        .NtQueryInformationFile    = (void*) 0x000A6FB8,
        .NtQueryKey                = (void*) 0x0011113C,
        .NtQueryValueKey           = (void*) 0x001113D2,
        .NtSetInformationFile      = (void*) 0x000A763E,
        .NtSetValueKey             = (void*) 0x00111A64,
        .ObpFreeObject             = (void*) 0x000D5C86,
        .PspTerminateProcess       = (void*) 0x000E0F1E,
        .swprintf                  = (void*) 0x00060420,
        .ZwOpenProcess             = (void*) 0x0002EFB8,
        .ZwProtectVirtualMemory    = (void*) 0x0002F088,
        .ZwReadVirtualMemory       = (void*) 0x0002F358,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7035 (english)"),
      TEXT("42258C0E1A2480"),
      {
        .NtCreateProcess           = (void*) 0x000E6218,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB90,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7280,
        .NtQueryInformationFile    = (void*) 0x000AC5F4,
        .NtQueryKey                = (void*) 0x0011761A,
        .NtQueryValueKey           = (void*) 0x001178B0,
        .NtSetInformationFile      = (void*) 0x000ACC7A,
        .NtSetValueKey             = (void*) 0x00117F42,
        .ObpFreeObject             = (void*) 0x000DBCA4,
        .PspTerminateProcess       = (void*) 0x000E7402,
        .swprintf                  = (void*) 0x000646E0,
        .ZwOpenProcess             = (void*) 0x0002FF18,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFE8,
        .ZwReadVirtualMemory       = (void*) 0x000302B8,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7035 (french)"),
      TEXT("42258C0E1A3240"),
      {
        .NtCreateProcess           = (void*) 0x000E6218,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB90,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7280,
        .NtQueryInformationFile    = (void*) 0x000AC5F4,
        .NtQueryKey                = (void*) 0x0011761A,
        .NtQueryValueKey           = (void*) 0x001178B0,
        .NtSetInformationFile      = (void*) 0x000ACC7A,
        .NtSetValueKey             = (void*) 0x00117F42,
        .ObpFreeObject             = (void*) 0x000DBCA4,
        .PspTerminateProcess       = (void*) 0x000E7402,
        .swprintf                  = (void*) 0x000646E0,
        .ZwOpenProcess             = (void*) 0x0002FF18,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFE8,
        .ZwReadVirtualMemory       = (void*) 0x000302B8,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7035 (german)"),
      TEXT("42258C0E1A2D40"),
      {
        .NtCreateProcess           = (void*) 0x000E6218,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB90,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7280,
        .NtQueryInformationFile    = (void*) 0x000AC5F4,
        .NtQueryKey                = (void*) 0x0011761A,
        .NtQueryValueKey           = (void*) 0x001178B0,
        .NtSetInformationFile      = (void*) 0x000ACC7A,
        .NtSetValueKey             = (void*) 0x00117F42,
        .ObpFreeObject             = (void*) 0x000DBCA4,
        .PspTerminateProcess       = (void*) 0x000E7402,
        .swprintf                  = (void*) 0x000646E0,
        .ZwOpenProcess             = (void*) 0x0002FF18,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFE8,
        .ZwReadVirtualMemory       = (void*) 0x000302B8,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7035 (spanish)"),
      TEXT("42258C0E1A38C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6218,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB90,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7280,
        .NtQueryInformationFile    = (void*) 0x000AC5F4,
        .NtQueryKey                = (void*) 0x0011761A,
        .NtQueryValueKey           = (void*) 0x001178B0,
        .NtSetInformationFile      = (void*) 0x000ACC7A,
        .NtSetValueKey             = (void*) 0x00117F42,
        .ObpFreeObject             = (void*) 0x000DBCA4,
        .PspTerminateProcess       = (void*) 0x000E7402,
        .swprintf                  = (void*) 0x000646E0,
        .ZwOpenProcess             = (void*) 0x0002FF18,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFE8,
        .ZwReadVirtualMemory       = (void*) 0x000302B8,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7035 (english)"),
      TEXT("42258BD819CB80"),
      {
        .NtCreateProcess           = (void*) 0x000E20C4,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E312C,
        .NtQueryInformationFile    = (void*) 0x000A8B74,
        .NtQueryKey                = (void*) 0x001134CC,
        .NtQueryValueKey           = (void*) 0x00113762,
        .NtSetInformationFile      = (void*) 0x000A91FA,
        .NtSetValueKey             = (void*) 0x00113DF4,
        .ObpFreeObject             = (void*) 0x000D7B48,
        .PspTerminateProcess       = (void*) 0x000E32AE,
        .swprintf                  = (void*) 0x00061440,
        .ZwOpenProcess             = (void*) 0x0002FEDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFAC,
        .ZwReadVirtualMemory       = (void*) 0x0003027C,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7035 (french)"),
      TEXT("42258BD819D940"),
      {
        .NtCreateProcess           = (void*) 0x000E20C4,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E312C,
        .NtQueryInformationFile    = (void*) 0x000A8B74,
        .NtQueryKey                = (void*) 0x001134CC,
        .NtQueryValueKey           = (void*) 0x00113762,
        .NtSetInformationFile      = (void*) 0x000A91FA,
        .NtSetValueKey             = (void*) 0x00113DF4,
        .ObpFreeObject             = (void*) 0x000D7B48,
        .PspTerminateProcess       = (void*) 0x000E32AE,
        .swprintf                  = (void*) 0x00061440,
        .ZwOpenProcess             = (void*) 0x0002FEDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFAC,
        .ZwReadVirtualMemory       = (void*) 0x0003027C,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7035 (german)"),
      TEXT("42258BD819D440"),
      {
        .NtCreateProcess           = (void*) 0x000E20C4,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E312C,
        .NtQueryInformationFile    = (void*) 0x000A8B74,
        .NtQueryKey                = (void*) 0x001134CC,
        .NtQueryValueKey           = (void*) 0x00113762,
        .NtSetInformationFile      = (void*) 0x000A91FA,
        .NtSetValueKey             = (void*) 0x00113DF4,
        .ObpFreeObject             = (void*) 0x000D7B48,
        .PspTerminateProcess       = (void*) 0x000E32AE,
        .swprintf                  = (void*) 0x00061440,
        .ZwOpenProcess             = (void*) 0x0002FEDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFAC,
        .ZwReadVirtualMemory       = (void*) 0x0003027C,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7035 (spanish)"),
      TEXT("42258BD819DFC0"),
      {
        .NtCreateProcess           = (void*) 0x000E20C4,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E312C,
        .NtQueryInformationFile    = (void*) 0x000A8B74,
        .NtQueryKey                = (void*) 0x001134CC,
        .NtQueryValueKey           = (void*) 0x00113762,
        .NtSetInformationFile      = (void*) 0x000A91FA,
        .NtSetValueKey             = (void*) 0x00113DF4,
        .ObpFreeObject             = (void*) 0x000D7B48,
        .PspTerminateProcess       = (void*) 0x000E32AE,
        .swprintf                  = (void*) 0x00061440,
        .ZwOpenProcess             = (void*) 0x0002FEDC,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFAC,
        .ZwReadVirtualMemory       = (void*) 0x0003027C,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7045 (?)"),
      TEXT("427B58D31A7B40"),
      {
        .NtCreateProcess           = (void*) 0x000EA7F8,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D30D6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB862,
        .NtQueryInformationFile    = (void*) 0x000B0BFE,
        .NtQueryKey                = (void*) 0x0011BC5A,
        .NtQueryValueKey           = (void*) 0x0011BEF0,
        .NtSetInformationFile      = (void*) 0x000B1276,
        .NtSetValueKey             = (void*) 0x0011C582,
        .ObpFreeObject             = (void*) 0x000E0274,
        .PspTerminateProcess       = (void*) 0x000EB9E4,
        .swprintf                  = (void*) 0x00067220,
        .ZwOpenProcess             = (void*) 0x00031C54,
        .ZwProtectVirtualMemory    = (void*) 0x00031D24,
        .ZwReadVirtualMemory       = (void*) 0x00031FF4,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7045 (german)"),
      TEXT("427B58D31A8400"),
      {
        .NtCreateProcess           = (void*) 0x000EA7F8,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D30D6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB862,
        .NtQueryInformationFile    = (void*) 0x000B0BFE,
        .NtQueryKey                = (void*) 0x0011BC5A,
        .NtQueryValueKey           = (void*) 0x0011BEF0,
        .NtSetInformationFile      = (void*) 0x000B1276,
        .NtSetValueKey             = (void*) 0x0011C582,
        .ObpFreeObject             = (void*) 0x000E0274,
        .PspTerminateProcess       = (void*) 0x000EB9E4,
        .swprintf                  = (void*) 0x00067220,
        .ZwOpenProcess             = (void*) 0x00031C54,
        .ZwProtectVirtualMemory    = (void*) 0x00031D24,
        .ZwReadVirtualMemory       = (void*) 0x00031FF4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7045 (english)"),
      TEXT("427B58D31A2480"),
      {
        .NtCreateProcess           = (void*) 0x000E620C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB84,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7274,
        .NtQueryInformationFile    = (void*) 0x000AC5F2,
        .NtQueryKey                = (void*) 0x0011760C,
        .NtQueryValueKey           = (void*) 0x001178A2,
        .NtSetInformationFile      = (void*) 0x000ACC78,
        .NtSetValueKey             = (void*) 0x00117F34,
        .ObpFreeObject             = (void*) 0x000DBC98,
        .PspTerminateProcess       = (void*) 0x000E73F6,
        .swprintf                  = (void*) 0x000646F0,
        .ZwOpenProcess             = (void*) 0x0002FF24,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFF4,
        .ZwReadVirtualMemory       = (void*) 0x000302C4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7045 (french)"),
      TEXT("427B58D31A3240"),
      {
        .NtCreateProcess           = (void*) 0x000E620C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB84,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7274,
        .NtQueryInformationFile    = (void*) 0x000AC5F2,
        .NtQueryKey                = (void*) 0x0011760C,
        .NtQueryValueKey           = (void*) 0x001178A2,
        .NtSetInformationFile      = (void*) 0x000ACC78,
        .NtSetValueKey             = (void*) 0x00117F34,
        .ObpFreeObject             = (void*) 0x000DBC98,
        .PspTerminateProcess       = (void*) 0x000E73F6,
        .swprintf                  = (void*) 0x000646F0,
        .ZwOpenProcess             = (void*) 0x0002FF24,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFF4,
        .ZwReadVirtualMemory       = (void*) 0x000302C4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7045 (spanish)"),
      TEXT("427B58D31A38C0"),
      {
        .NtCreateProcess           = (void*) 0x000E620C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB84,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7274,
        .NtQueryInformationFile    = (void*) 0x000AC5F2,
        .NtQueryKey                = (void*) 0x0011760C,
        .NtQueryValueKey           = (void*) 0x001178A2,
        .NtSetInformationFile      = (void*) 0x000ACC78,
        .NtSetValueKey             = (void*) 0x00117F34,
        .ObpFreeObject             = (void*) 0x000DBC98,
        .PspTerminateProcess       = (void*) 0x000E73F6,
        .swprintf                  = (void*) 0x000646F0,
        .ZwOpenProcess             = (void*) 0x0002FF24,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFF4,
        .ZwReadVirtualMemory       = (void*) 0x000302C4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7045 (1)"),
      TEXT("427B58D31A2D40"),
      {
        .NtCreateProcess           = (void*) 0x000E620C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB84,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7274,
        .NtQueryInformationFile    = (void*) 0x000AC5F2,
        .NtQueryKey                = (void*) 0x0011760C,
        .NtQueryValueKey           = (void*) 0x001178A2,
        .NtSetInformationFile      = (void*) 0x000ACC78,
        .NtSetValueKey             = (void*) 0x00117F34,
        .ObpFreeObject             = (void*) 0x000DBC98,
        .PspTerminateProcess       = (void*) 0x000E73F6,
        .swprintf                  = (void*) 0x000646F0,
        .ZwOpenProcess             = (void*) 0x0002FF24,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFF4,
        .ZwReadVirtualMemory       = (void*) 0x000302C4,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7045 (2)"),
      TEXT("427B58D31C7C00"),
      {
        .NtCreateProcess           = (void*) 0x000E620C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CEB84,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7274,
        .NtQueryInformationFile    = (void*) 0x000AC5F2,
        .NtQueryKey                = (void*) 0x0011760C,
        .NtQueryValueKey           = (void*) 0x001178A2,
        .NtSetInformationFile      = (void*) 0x000ACC78,
        .NtSetValueKey             = (void*) 0x00117F34,
        .ObpFreeObject             = (void*) 0x000DBC98,
        .PspTerminateProcess       = (void*) 0x000E73F6,
        .swprintf                  = (void*) 0x000646F0,
        .ZwOpenProcess             = (void*) 0x0002FF24,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFF4,
        .ZwReadVirtualMemory       = (void*) 0x000302C4,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7045 (english)"),
      TEXT("427B58BB19CB40"),
      {
        .NtCreateProcess           = (void*) 0x000E20BE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3126,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x001134BE,
        .NtQueryValueKey           = (void*) 0x00113754,
        .NtSetInformationFile      = (void*) 0x000A91F8,
        .NtSetValueKey             = (void*) 0x00113DE6,
        .ObpFreeObject             = (void*) 0x000D7B4A,
        .PspTerminateProcess       = (void*) 0x000E32A8,
        .swprintf                  = (void*) 0x00061450,
        .ZwOpenProcess             = (void*) 0x0002FEF4,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFC4,
        .ZwReadVirtualMemory       = (void*) 0x00030294,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7045 (french)"),
      TEXT("427B58BB19D900"),
      {
        .NtCreateProcess           = (void*) 0x000E20BE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3126,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x001134BE,
        .NtQueryValueKey           = (void*) 0x00113754,
        .NtSetInformationFile      = (void*) 0x000A91F8,
        .NtSetValueKey             = (void*) 0x00113DE6,
        .ObpFreeObject             = (void*) 0x000D7B4A,
        .PspTerminateProcess       = (void*) 0x000E32A8,
        .swprintf                  = (void*) 0x00061450,
        .ZwOpenProcess             = (void*) 0x0002FEF4,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFC4,
        .ZwReadVirtualMemory       = (void*) 0x00030294,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7045 (spanish)"),
      TEXT("427B58BB19DF80"),
      {
        .NtCreateProcess           = (void*) 0x000E20BE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3126,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x001134BE,
        .NtQueryValueKey           = (void*) 0x00113754,
        .NtSetInformationFile      = (void*) 0x000A91F8,
        .NtSetValueKey             = (void*) 0x00113DE6,
        .ObpFreeObject             = (void*) 0x000D7B4A,
        .PspTerminateProcess       = (void*) 0x000E32A8,
        .swprintf                  = (void*) 0x00061450,
        .ZwOpenProcess             = (void*) 0x0002FEF4,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFC4,
        .ZwReadVirtualMemory       = (void*) 0x00030294,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7045 (1)"),
      TEXT("427B58BB19D400"),
      {
        .NtCreateProcess           = (void*) 0x000E20BE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3126,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x001134BE,
        .NtQueryValueKey           = (void*) 0x00113754,
        .NtSetInformationFile      = (void*) 0x000A91F8,
        .NtSetValueKey             = (void*) 0x00113DE6,
        .ObpFreeObject             = (void*) 0x000D7B4A,
        .PspTerminateProcess       = (void*) 0x000E32A8,
        .swprintf                  = (void*) 0x00061450,
        .ZwOpenProcess             = (void*) 0x0002FEF4,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFC4,
        .ZwReadVirtualMemory       = (void*) 0x00030294,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7045 (2)"),
      TEXT("427B58BB1C22C0"),
      {
        .NtCreateProcess           = (void*) 0x000E20BE,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CAF6C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3126,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x001134BE,
        .NtQueryValueKey           = (void*) 0x00113754,
        .NtSetInformationFile      = (void*) 0x000A91F8,
        .NtSetValueKey             = (void*) 0x00113DE6,
        .ObpFreeObject             = (void*) 0x000D7B4A,
        .PspTerminateProcess       = (void*) 0x000E32A8,
        .swprintf                  = (void*) 0x00061450,
        .ZwOpenProcess             = (void*) 0x0002FEF4,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFC4,
        .ZwReadVirtualMemory       = (void*) 0x00030294,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7045 (?)"),
      TEXT("427B58BB1A2840"),
      {
        .NtCreateProcess           = (void*) 0x000E6AC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CF900,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7B2C,
        .NtQueryInformationFile    = (void*) 0x000AD57E,
        .NtQueryKey                = (void*) 0x00117F18,
        .NtQueryValueKey           = (void*) 0x001181AE,
        .NtSetInformationFile      = (void*) 0x000ADBF6,
        .NtSetValueKey             = (void*) 0x00118840,
        .ObpFreeObject             = (void*) 0x000DC546,
        .PspTerminateProcess       = (void*) 0x000E7CAE,
        .swprintf                  = (void*) 0x00064280,
        .ZwOpenProcess             = (void*) 0x00031B18,
        .ZwProtectVirtualMemory    = (void*) 0x00031BE8,
        .ZwReadVirtualMemory       = (void*) 0x00031EB8,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7045 (german)"),
      TEXT("427B58BB1A3100"),
      {
        .NtCreateProcess           = (void*) 0x000E6AC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CF900,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7B2C,
        .NtQueryInformationFile    = (void*) 0x000AD57E,
        .NtQueryKey                = (void*) 0x00117F18,
        .NtQueryValueKey           = (void*) 0x001181AE,
        .NtSetInformationFile      = (void*) 0x000ADBF6,
        .NtSetValueKey             = (void*) 0x00118840,
        .ObpFreeObject             = (void*) 0x000DC546,
        .PspTerminateProcess       = (void*) 0x000E7CAE,
        .swprintf                  = (void*) 0x00064280,
        .ZwOpenProcess             = (void*) 0x00031B18,
        .ZwProtectVirtualMemory    = (void*) 0x00031BE8,
        .ZwReadVirtualMemory       = (void*) 0x00031EB8,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7071 (english)"),
      TEXT("4344EC6C1A7D00"),
      {
        .NtCreateProcess           = (void*) 0x000EA9DA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D32C0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EBA44,
        .NtQueryInformationFile    = (void*) 0x000B0DCE,
        .NtQueryKey                = (void*) 0x0011BE32,
        .NtQueryValueKey           = (void*) 0x0011C0C8,
        .NtSetInformationFile      = (void*) 0x000B1446,
        .NtSetValueKey             = (void*) 0x0011C75A,
        .ObpFreeObject             = (void*) 0x000E045E,
        .PspTerminateProcess       = (void*) 0x000EBBC6,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7071 (english)"),
      TEXT("4344EC6C1A25C0"),
      {
        .NtCreateProcess           = (void*) 0x000E639C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CED08,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7404,
        .NtQueryInformationFile    = (void*) 0x000AC784,
        .NtQueryKey                = (void*) 0x0011779E,
        .NtQueryValueKey           = (void*) 0x00117A34,
        .NtSetInformationFile      = (void*) 0x000ACE0A,
        .NtSetValueKey             = (void*) 0x001180C6,
        .ObpFreeObject             = (void*) 0x000DBE20,
        .PspTerminateProcess       = (void*) 0x000E7586,
        .swprintf                  = (void*) 0x00064760,
        .ZwOpenProcess             = (void*) 0x0002FF2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFFC,
        .ZwReadVirtualMemory       = (void*) 0x000302CC,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7071 (german)"),
      TEXT("4344EC6C1A2E80"),
      {
        .NtCreateProcess           = (void*) 0x000E639C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CED08,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7404,
        .NtQueryInformationFile    = (void*) 0x000AC784,
        .NtQueryKey                = (void*) 0x0011779E,
        .NtQueryValueKey           = (void*) 0x00117A34,
        .NtSetInformationFile      = (void*) 0x000ACE0A,
        .NtSetValueKey             = (void*) 0x001180C6,
        .ObpFreeObject             = (void*) 0x000DBE20,
        .PspTerminateProcess       = (void*) 0x000E7586,
        .swprintf                  = (void*) 0x00064760,
        .ZwOpenProcess             = (void*) 0x0002FF2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFFC,
        .ZwReadVirtualMemory       = (void*) 0x000302CC,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7071 (italian)"),
      TEXT("4344EC6C1C7D40"),
      {
        .NtCreateProcess           = (void*) 0x000E639C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CED08,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7404,
        .NtQueryInformationFile    = (void*) 0x000AC784,
        .NtQueryKey                = (void*) 0x0011779E,
        .NtQueryValueKey           = (void*) 0x00117A34,
        .NtSetInformationFile      = (void*) 0x000ACE0A,
        .NtSetValueKey             = (void*) 0x001180C6,
        .ObpFreeObject             = (void*) 0x000DBE20,
        .PspTerminateProcess       = (void*) 0x000E7586,
        .swprintf                  = (void*) 0x00064760,
        .ZwOpenProcess             = (void*) 0x0002FF2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFFC,
        .ZwReadVirtualMemory       = (void*) 0x000302CC,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7071 (spanish)"),
      TEXT("4344EC6C1A3A00"),
      {
        .NtCreateProcess           = (void*) 0x000E639C,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CED08,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7404,
        .NtQueryInformationFile    = (void*) 0x000AC784,
        .NtQueryKey                = (void*) 0x0011779E,
        .NtQueryValueKey           = (void*) 0x00117A34,
        .NtSetInformationFile      = (void*) 0x000ACE0A,
        .NtSetValueKey             = (void*) 0x001180C6,
        .ObpFreeObject             = (void*) 0x000DBE20,
        .PspTerminateProcess       = (void*) 0x000E7586,
        .swprintf                  = (void*) 0x00064760,
        .ZwOpenProcess             = (void*) 0x0002FF2C,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFFC,
        .ZwReadVirtualMemory       = (void*) 0x000302CC,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7071 (english)"),
      TEXT("4344EC5919CD80"),
      {
        .NtCreateProcess           = (void*) 0x000E22BA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB164,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3322,
        .NtQueryInformationFile    = (void*) 0x000A8D84,
        .NtQueryKey                = (void*) 0x001136C8,
        .NtQueryValueKey           = (void*) 0x0011395E,
        .NtSetInformationFile      = (void*) 0x000A940A,
        .NtSetValueKey             = (void*) 0x00113FF0,
        .ObpFreeObject             = (void*) 0x000D7D3E,
        .PspTerminateProcess       = (void*) 0x000E34A4,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7071 (german)"),
      TEXT("4344EC5919D640"),
      {
        .NtCreateProcess           = (void*) 0x000E22BA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB164,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3322,
        .NtQueryInformationFile    = (void*) 0x000A8D84,
        .NtQueryKey                = (void*) 0x001136C8,
        .NtQueryValueKey           = (void*) 0x0011395E,
        .NtSetInformationFile      = (void*) 0x000A940A,
        .NtSetValueKey             = (void*) 0x00113FF0,
        .ObpFreeObject             = (void*) 0x000D7D3E,
        .PspTerminateProcess       = (void*) 0x000E34A4,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7071 (italian)"),
      TEXT("4344EC591C2500"),
      {
        .NtCreateProcess           = (void*) 0x000E22BA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB164,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3322,
        .NtQueryInformationFile    = (void*) 0x000A8D84,
        .NtQueryKey                = (void*) 0x001136C8,
        .NtQueryValueKey           = (void*) 0x0011395E,
        .NtSetInformationFile      = (void*) 0x000A940A,
        .NtSetValueKey             = (void*) 0x00113FF0,
        .ObpFreeObject             = (void*) 0x000D7D3E,
        .PspTerminateProcess       = (void*) 0x000E34A4,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7071 (spanish)"),
      TEXT("4344EC5919E1C0"),
      {
        .NtCreateProcess           = (void*) 0x000E22BA,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB164,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E3322,
        .NtQueryInformationFile    = (void*) 0x000A8D84,
        .NtQueryKey                = (void*) 0x001136C8,
        .NtQueryValueKey           = (void*) 0x0011395E,
        .NtSetInformationFile      = (void*) 0x000A940A,
        .NtSetValueKey             = (void*) 0x00113FF0,
        .ObpFreeObject             = (void*) 0x000D7D3E,
        .PspTerminateProcess       = (void*) 0x000E34A4,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7071 (english)"),
      TEXT("4344EC591A29C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6C58,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA96,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7CC2,
        .NtQueryInformationFile    = (void*) 0x000AD70E,
        .NtQueryKey                = (void*) 0x001180B0,
        .NtQueryValueKey           = (void*) 0x00118346,
        .NtSetInformationFile      = (void*) 0x000ADD86,
        .NtSetValueKey             = (void*) 0x001189D8,
        .ObpFreeObject             = (void*) 0x000DC6DC,
        .PspTerminateProcess       = (void*) 0x000E7E44,
        .swprintf                  = (void*) 0x00064300,
        .ZwOpenProcess             = (void*) 0x00031B20,
        .ZwProtectVirtualMemory    = (void*) 0x00031BF0,
        .ZwReadVirtualMemory       = (void*) 0x00031EC0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7098 (english)"),
      TEXT("4492581F1A7C80"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDD8,
        .NtQueryValueKey           = (void*) 0x0011C06E,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C700,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7098 (english)"),
      TEXT("4492581F1A2580"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117744,
        .NtQueryValueKey           = (void*) 0x001179DA,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x0011806C,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7098 (french)"),
      TEXT("4492581F1A3340"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117744,
        .NtQueryValueKey           = (void*) 0x001179DA,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x0011806C,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7098 (italian)"),
      TEXT("4492581F1C7D00"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117744,
        .NtQueryValueKey           = (void*) 0x001179DA,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x0011806C,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7098 (spanish)"),
      TEXT("4492581F1A39C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117744,
        .NtQueryValueKey           = (void*) 0x001179DA,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x0011806C,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7098 (english)"),
      TEXT("4492580919CD00"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x0011366E,
        .NtQueryValueKey           = (void*) 0x00113904,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F96,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF04,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD4,
        .ZwReadVirtualMemory       = (void*) 0x000302A4,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7098 (french)"),
      TEXT("4492580919DAC0"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x0011366E,
        .NtQueryValueKey           = (void*) 0x00113904,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F96,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF04,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD4,
        .ZwReadVirtualMemory       = (void*) 0x000302A4,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7098 (italian)"),
      TEXT("449258091C2480"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x0011366E,
        .NtQueryValueKey           = (void*) 0x00113904,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F96,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF04,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD4,
        .ZwReadVirtualMemory       = (void*) 0x000302A4,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7098 (spanish)"),
      TEXT("4492580919E140"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x0011366E,
        .NtQueryValueKey           = (void*) 0x00113904,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F96,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF04,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD4,
        .ZwReadVirtualMemory       = (void*) 0x000302A4,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7098 (english)"),
      TEXT("449258091A2940"),
      {
        .NtCreateProcess           = (void*) 0x000E6C02,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA40,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C6C,
        .NtQueryInformationFile    = (void*) 0x000AD6B8,
        .NtQueryKey                = (void*) 0x00118056,
        .NtQueryValueKey           = (void*) 0x001182EC,
        .NtSetInformationFile      = (void*) 0x000ADD30,
        .NtSetValueKey             = (void*) 0x0011897E,
        .ObpFreeObject             = (void*) 0x000DC686,
        .PspTerminateProcess       = (void*) 0x000E7DEE,
        .swprintf                  = (void*) 0x00064300,
        .ZwOpenProcess             = (void*) 0x00031B20,
        .ZwProtectVirtualMemory    = (void*) 0x00031BF0,
        .ZwReadVirtualMemory       = (void*) 0x00031EC0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7111 (english)"),
      TEXT("45069E891A7C80"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDDC,
        .NtQueryValueKey           = (void*) 0x0011C072,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C704,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7111 (french)"),
      TEXT("45069E891A8A40"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDDC,
        .NtQueryValueKey           = (void*) 0x0011C072,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C704,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7111 (italian)"),
      TEXT("45069E891CD400"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDDC,
        .NtQueryValueKey           = (void*) 0x0011C072,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C704,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7111 (polish)"),
      TEXT("45069E891A82C0"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDDC,
        .NtQueryValueKey           = (void*) 0x0011C072,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C704,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrpamp 5.00.2195.7111 (spanish)"),
      TEXT("45069E891A90C0"),
      {
        .NtCreateProcess           = (void*) 0x000EA984,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000D326A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EB9EE,
        .NtQueryInformationFile    = (void*) 0x000B0D78,
        .NtQueryKey                = (void*) 0x0011BDDC,
        .NtQueryValueKey           = (void*) 0x0011C072,
        .NtSetInformationFile      = (void*) 0x000B13F0,
        .NtSetValueKey             = (void*) 0x0011C704,
        .ObpFreeObject             = (void*) 0x000E0408,
        .PspTerminateProcess       = (void*) 0x000EBB70,
        .swprintf                  = (void*) 0x00067290,
        .ZwOpenProcess             = (void*) 0x00031C50,
        .ZwProtectVirtualMemory    = (void*) 0x00031D20,
        .ZwReadVirtualMemory       = (void*) 0x00031FF0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111"),
      TEXT("45069E861C7D00"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (dutch)"),
      TEXT("45069E861A3140"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (english)"),
      TEXT("45069E861A2580"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (finnish)"),
      TEXT("45069E861A27C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (french)"),
      TEXT("45069E861A3340"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (german)"),
      TEXT("45069E861A2E40"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (greek)"),
      TEXT("45069E861C8A80"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (polish)"),
      TEXT("45069E861A2BC0"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (spanish)"),
      TEXT("45069E861A39C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntkrnlpa 5.00.2195.7111 (swedish)"),
      TEXT("45069E861A7340"),
      {
        .NtCreateProcess           = (void*) 0x000E6346,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CECB2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E73AE,
        .NtQueryInformationFile    = (void*) 0x000AC72E,
        .NtQueryKey                = (void*) 0x00117748,
        .NtQueryValueKey           = (void*) 0x001179DE,
        .NtSetInformationFile      = (void*) 0x000ACDB4,
        .NtSetValueKey             = (void*) 0x00118070,
        .ObpFreeObject             = (void*) 0x000DBDCA,
        .PspTerminateProcess       = (void*) 0x000E7530,
        .swprintf                  = (void*) 0x00064770,
        .ZwOpenProcess             = (void*) 0x0002FF30,
        .ZwProtectVirtualMemory    = (void*) 0x00030000,
        .ZwReadVirtualMemory       = (void*) 0x000302D0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111"),
      TEXT("45069E6E1C2480"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (dutch)"),
      TEXT("45069E6E19D8C0"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (english)"),
      TEXT("45069E6E19CD00"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (finnish)"),
      TEXT("45069E6E19CF40"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (french)"),
      TEXT("45069E6E19DAC0"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (german)"),
      TEXT("45069E6E19D5C0"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (greek)"),
      TEXT("45069E6E1C3200"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (polish)"),
      TEXT("45069E6E19D340"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (spanish)"),
      TEXT("45069E6E19E140"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntoskrnl 5.00.2195.7111 (swedish)"),
      TEXT("45069E6E1A1AC0"),
      {
        .NtCreateProcess           = (void*) 0x000E2264,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CB10E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E32CC,
        .NtQueryInformationFile    = (void*) 0x000A8D2E,
        .NtQueryKey                = (void*) 0x00113672,
        .NtQueryValueKey           = (void*) 0x00113908,
        .NtSetInformationFile      = (void*) 0x000A93B4,
        .NtSetValueKey             = (void*) 0x00113F9A,
        .ObpFreeObject             = (void*) 0x000D7CE8,
        .PspTerminateProcess       = (void*) 0x000E344E,
        .swprintf                  = (void*) 0x000614D0,
        .ZwOpenProcess             = (void*) 0x0002FF00,
        .ZwProtectVirtualMemory    = (void*) 0x0002FFD0,
        .ZwReadVirtualMemory       = (void*) 0x000302A0,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7111 (english)"),
      TEXT("45069E6E1A2900"),
      {
        .NtCreateProcess           = (void*) 0x000E6BC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA00,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C2C,
        .NtQueryInformationFile    = (void*) 0x000AD678,
        .NtQueryKey                = (void*) 0x0011801A,
        .NtQueryValueKey           = (void*) 0x001182B0,
        .NtSetInformationFile      = (void*) 0x000ADCF0,
        .NtSetValueKey             = (void*) 0x00118942,
        .ObpFreeObject             = (void*) 0x000DC646,
        .PspTerminateProcess       = (void*) 0x000E7DAE,
        .swprintf                  = (void*) 0x000642F0,
        .ZwOpenProcess             = (void*) 0x00031B1C,
        .ZwProtectVirtualMemory    = (void*) 0x00031BEC,
        .ZwReadVirtualMemory       = (void*) 0x00031EBC,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7111 (french)"),
      TEXT("45069E6E1A36C0"),
      {
        .NtCreateProcess           = (void*) 0x000E6BC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA00,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C2C,
        .NtQueryInformationFile    = (void*) 0x000AD678,
        .NtQueryKey                = (void*) 0x0011801A,
        .NtQueryValueKey           = (void*) 0x001182B0,
        .NtSetInformationFile      = (void*) 0x000ADCF0,
        .NtSetValueKey             = (void*) 0x00118942,
        .ObpFreeObject             = (void*) 0x000DC646,
        .PspTerminateProcess       = (void*) 0x000E7DAE,
        .swprintf                  = (void*) 0x000642F0,
        .ZwOpenProcess             = (void*) 0x00031B1C,
        .ZwProtectVirtualMemory    = (void*) 0x00031BEC,
        .ZwReadVirtualMemory       = (void*) 0x00031EBC,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7111 (italian)"),
      TEXT("45069E6E1C8080"),
      {
        .NtCreateProcess           = (void*) 0x000E6BC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA00,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C2C,
        .NtQueryInformationFile    = (void*) 0x000AD678,
        .NtQueryKey                = (void*) 0x0011801A,
        .NtQueryValueKey           = (void*) 0x001182B0,
        .NtSetInformationFile      = (void*) 0x000ADCF0,
        .NtSetValueKey             = (void*) 0x00118942,
        .ObpFreeObject             = (void*) 0x000DC646,
        .PspTerminateProcess       = (void*) 0x000E7DAE,
        .swprintf                  = (void*) 0x000642F0,
        .ZwOpenProcess             = (void*) 0x00031B1C,
        .ZwProtectVirtualMemory    = (void*) 0x00031BEC,
        .ZwReadVirtualMemory       = (void*) 0x00031EBC,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7111 (polish)"),
      TEXT("45069E6E1A2F40"),
      {
        .NtCreateProcess           = (void*) 0x000E6BC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA00,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C2C,
        .NtQueryInformationFile    = (void*) 0x000AD678,
        .NtQueryKey                = (void*) 0x0011801A,
        .NtQueryValueKey           = (void*) 0x001182B0,
        .NtSetInformationFile      = (void*) 0x000ADCF0,
        .NtSetValueKey             = (void*) 0x00118942,
        .ObpFreeObject             = (void*) 0x000DC646,
        .PspTerminateProcess       = (void*) 0x000E7DAE,
        .swprintf                  = (void*) 0x000642F0,
        .ZwOpenProcess             = (void*) 0x00031B1C,
        .ZwProtectVirtualMemory    = (void*) 0x00031BEC,
        .ZwReadVirtualMemory       = (void*) 0x00031EBC,
      }
    },
    {
      TEXT("ntkrnlmp 5.00.2195.7111 (spanish)"),
      TEXT("45069E6E1A3D40"),
      {
        .NtCreateProcess           = (void*) 0x000E6BC2,
        .NtCreateProcessEx         = NULL,
        .NtCreateSection           = (void*) 0x000CFA00,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7C2C,
        .NtQueryInformationFile    = (void*) 0x000AD678,
        .NtQueryKey                = (void*) 0x0011801A,
        .NtQueryValueKey           = (void*) 0x001182B0,
        .NtSetInformationFile      = (void*) 0x000ADCF0,
        .NtSetValueKey             = (void*) 0x00118942,
        .ObpFreeObject             = (void*) 0x000DC646,
        .PspTerminateProcess       = (void*) 0x000E7DAE,
        .swprintf                  = (void*) 0x000642F0,
        .ZwOpenProcess             = (void*) 0x00031B1C,
        .ZwProtectVirtualMemory    = (void*) 0x00031BEC,
        .ZwReadVirtualMemory       = (void*) 0x00031EBC,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.0 (xpclient.010817-1148)"),
      TEXT("0ABB7E73C24942C6A610FDB19159E3CC1"),
      {
        .NtCreateProcess           = (void*) 0x000D90DE,
        .NtCreateProcessEx         = (void*) 0x000D9036,
        .NtCreateSection           = (void*) 0x000B36D0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DA28C,
        .NtQueryInformationFile    = (void*) 0x00086096,
        .NtQueryKey                = (void*) 0x00127F7E,
        .NtQueryValueKey           = (void*) 0x00124D76,
        .NtSetInformationFile      = (void*) 0x00086686,
        .NtSetValueKey             = (void*) 0x0012533A,
        .ObpFreeObject             = (void*) 0x000C9708,
        .PspTerminateProcess       = (void*) 0x000DA3FE,
        .swprintf                  = (void*) 0x00056070,
        .ZwOpenProcess             = (void*) 0x000241D8,
        .ZwProtectVirtualMemory    = (void*) 0x00024304,
        .ZwReadVirtualMemory       = (void*) 0x000246D8,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.0 (xpclient.010817-1148)"),
      TEXT("DA37FCA19A614EB98EE2A3CF30E625392"),
      {
        .NtCreateProcess           = (void*) 0x000CA61D,
        .NtCreateProcessEx         = (void*) 0x000B0346,
        .NtCreateSection           = (void*) 0x000A11D5,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0009C6DC,
        .NtQueryInformationFile    = (void*) 0x000A6210,
        .NtQueryKey                = (void*) 0x0008B86B,
        .NtQueryValueKey           = (void*) 0x000A5D81,
        .NtSetInformationFile      = (void*) 0x000B181D,
        .NtSetValueKey             = (void*) 0x00093215,
        .ObpFreeObject             = (void*) 0x000A0975,
        .PspTerminateProcess       = (void*) 0x00136477,
        .swprintf                  = (void*) 0x00021D42,
        .ZwOpenProcess             = (void*) 0x0003B7EE,
        .ZwProtectVirtualMemory    = (void*) 0x0003B91A,
        .ZwReadVirtualMemory       = (void*) 0x0003BCEE,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.31 (xpclnt_qfe.010827-1803)"),
      TEXT("80423993DFF1461BB91D5B2FF59D15604"),
      {
        .NtCreateProcess           = (void*) 0x000D9934,
        .NtCreateProcessEx         = (void*) 0x000D988C,
        .NtCreateSection           = (void*) 0x000B3E3A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DAAF0,
        .NtQueryInformationFile    = (void*) 0x0008680A,
        .NtQueryKey                = (void*) 0x001283B2,
        .NtQueryValueKey           = (void*) 0x001251AA,
        .NtSetInformationFile      = (void*) 0x00086DFA,
        .NtSetValueKey             = (void*) 0x0012576E,
        .ObpFreeObject             = (void*) 0x000C9F5E,
        .PspTerminateProcess       = (void*) 0x000DAC62,
        .swprintf                  = (void*) 0x000560B0,
        .ZwOpenProcess             = (void*) 0x00024208,
        .ZwProtectVirtualMemory    = (void*) 0x00024334,
        .ZwReadVirtualMemory       = (void*) 0x00024708,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.31 (xpclnt_qfe.010827-1803)"),
      TEXT("A6C32BE0B0FD4CE7B42CF7C11D3214FC4"),
      {
        .NtCreateProcess           = (void*) 0x000D40C2,
        .NtCreateProcessEx         = (void*) 0x000D401A,
        .NtCreateSection           = (void*) 0x000AF04E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D5262,
        .NtQueryInformationFile    = (void*) 0x00081B8C,
        .NtQueryKey                = (void*) 0x00122B38,
        .NtQueryValueKey           = (void*) 0x0011F930,
        .NtSetInformationFile      = (void*) 0x0008217C,
        .NtSetValueKey             = (void*) 0x0011FEF4,
        .ObpFreeObject             = (void*) 0x000C46F4,
        .PspTerminateProcess       = (void*) 0x000D53D4,
        .swprintf                  = (void*) 0x000532E0,
        .ZwOpenProcess             = (void*) 0x00024168,
        .ZwProtectVirtualMemory    = (void*) 0x00024294,
        .ZwReadVirtualMemory       = (void*) 0x00024668,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.34 (xpclnt_qfe.010827-1803)"),
      TEXT("80423993DFF1461BB91D5B2FF59D15607"),
      {
        .NtCreateProcess           = (void*) 0x000D9834,
        .NtCreateProcessEx         = (void*) 0x000D978C,
        .NtCreateSection           = (void*) 0x000B3D42,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DA9D4,
        .NtQueryInformationFile    = (void*) 0x0008670C,
        .NtQueryKey                = (void*) 0x001282BA,
        .NtQueryValueKey           = (void*) 0x001250B2,
        .NtSetInformationFile      = (void*) 0x00086CFC,
        .NtSetValueKey             = (void*) 0x00125676,
        .ObpFreeObject             = (void*) 0x000C9E66,
        .PspTerminateProcess       = (void*) 0x000DAB46,
        .swprintf                  = (void*) 0x000560B0,
        .ZwOpenProcess             = (void*) 0x00024208,
        .ZwProtectVirtualMemory    = (void*) 0x00024334,
        .ZwReadVirtualMemory       = (void*) 0x00024708,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.34 (xpclnt_qfe.010827-1803)"),
      TEXT("A6C32BE0B0FD4CE7B42CF7C11D3214FC7"),
      {
        .NtCreateProcess           = (void*) 0x000D404A,
        .NtCreateProcessEx         = (void*) 0x000D3FA2,
        .NtCreateSection           = (void*) 0x000AEFCA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D51EA,
        .NtQueryInformationFile    = (void*) 0x00081B08,
        .NtQueryKey                = (void*) 0x00122ABA,
        .NtQueryValueKey           = (void*) 0x0011F8B2,
        .NtSetInformationFile      = (void*) 0x000820F8,
        .NtSetValueKey             = (void*) 0x0011FE76,
        .ObpFreeObject             = (void*) 0x000C4670,
        .PspTerminateProcess       = (void*) 0x000D535C,
        .swprintf                  = (void*) 0x000532E0,
        .ZwOpenProcess             = (void*) 0x00024168,
        .ZwProtectVirtualMemory    = (void*) 0x00024294,
        .ZwReadVirtualMemory       = (void*) 0x00024668,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.108 (xpclnt_qfe.021108-2107)"),
      TEXT("E086B943FAE142BEBD7E5F280ADF14585"),
      {
        .NtCreateProcess           = (void*) 0x000D9814,
        .NtCreateProcessEx         = (void*) 0x000D976C,
        .NtCreateSection           = (void*) 0x000B3D36,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DA9B4,
        .NtQueryInformationFile    = (void*) 0x0008670C,
        .NtQueryKey                = (void*) 0x00128294,
        .NtQueryValueKey           = (void*) 0x0012508C,
        .NtSetInformationFile      = (void*) 0x00086CFC,
        .NtSetValueKey             = (void*) 0x00125650,
        .ObpFreeObject             = (void*) 0x000C9E5A,
        .PspTerminateProcess       = (void*) 0x000DAB26,
        .swprintf                  = (void*) 0x00056080,
        .ZwOpenProcess             = (void*) 0x000241B0,
        .ZwProtectVirtualMemory    = (void*) 0x000242DC,
        .ZwReadVirtualMemory       = (void*) 0x000246B0,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.108 (xpclnt_qfe.021108-2107)"),
      TEXT("15317AB7420A427FB0CD6DEFE09530A35"),
      {
        .NtCreateProcess           = (void*) 0x000D4098,
        .NtCreateProcessEx         = (void*) 0x000D3FF0,
        .NtCreateSection           = (void*) 0x000AF044,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D5246,
        .NtQueryInformationFile    = (void*) 0x00081B98,
        .NtQueryKey                = (void*) 0x00122B18,
        .NtQueryValueKey           = (void*) 0x0011F910,
        .NtSetInformationFile      = (void*) 0x00082188,
        .NtSetValueKey             = (void*) 0x0011FED4,
        .ObpFreeObject             = (void*) 0x000C46EA,
        .PspTerminateProcess       = (void*) 0x000D53B8,
        .swprintf                  = (void*) 0x000532F0,
        .ZwOpenProcess             = (void*) 0x00024128,
        .ZwProtectVirtualMemory    = (void*) 0x00024254,
        .ZwReadVirtualMemory       = (void*) 0x00024628,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.115 (xpclnt_qfe.021108-2107)"),
      TEXT("E086B943FAE142BEBD7E5F280ADF14587"),
      {
        .NtCreateProcess           = (void*) 0x000D97D4,
        .NtCreateProcessEx         = (void*) 0x000D972C,
        .NtCreateSection           = (void*) 0x000B3CF6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DA974,
        .NtQueryInformationFile    = (void*) 0x0008670C,
        .NtQueryKey                = (void*) 0x0012822A,
        .NtQueryValueKey           = (void*) 0x00125022,
        .NtSetInformationFile      = (void*) 0x00086CFC,
        .NtSetValueKey             = (void*) 0x001255E6,
        .ObpFreeObject             = (void*) 0x000C9E1A,
        .PspTerminateProcess       = (void*) 0x000DAAE6,
        .swprintf                  = (void*) 0x000560A0,
        .ZwOpenProcess             = (void*) 0x000241B0,
        .ZwProtectVirtualMemory    = (void*) 0x000242DC,
        .ZwReadVirtualMemory       = (void*) 0x000246B0,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.115 (xpclnt_qfe.021108-2107)"),
      TEXT("15317AB7420A427FB0CD6DEFE09530A37"),
      {
        .NtCreateProcess           = (void*) 0x000D4062,
        .NtCreateProcessEx         = (void*) 0x000D3FBA,
        .NtCreateSection           = (void*) 0x000AF006,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D5210,
        .NtQueryInformationFile    = (void*) 0x00081B94,
        .NtQueryKey                = (void*) 0x00122AAA,
        .NtQueryValueKey           = (void*) 0x0011F8A2,
        .NtSetInformationFile      = (void*) 0x00082184,
        .NtSetValueKey             = (void*) 0x0011FE66,
        .ObpFreeObject             = (void*) 0x000C46AC,
        .PspTerminateProcess       = (void*) 0x000D5382,
        .swprintf                  = (void*) 0x00053320,
        .ZwOpenProcess             = (void*) 0x00024128,
        .ZwProtectVirtualMemory    = (void*) 0x00024254,
        .ZwReadVirtualMemory       = (void*) 0x00024628,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.160 (xpclnt_qfe.021108-2107)"),
      TEXT("A75D8A76665C4D4DA4286E245C3320974"),
      {
        .NtCreateProcess           = (void*) 0x000D9D3A,
        .NtCreateProcessEx         = (void*) 0x000D9C92,
        .NtCreateSection           = (void*) 0x000B405E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DAEDA,
        .NtQueryInformationFile    = (void*) 0x00086B96,
        .NtQueryKey                = (void*) 0x001289B8,
        .NtQueryValueKey           = (void*) 0x001257B0,
        .NtSetInformationFile      = (void*) 0x00087186,
        .NtSetValueKey             = (void*) 0x00125D74,
        .ObpFreeObject             = (void*) 0x000CA182,
        .PspTerminateProcess       = (void*) 0x000DB04C,
        .swprintf                  = (void*) 0x00056410,
        .ZwOpenProcess             = (void*) 0x00024298,
        .ZwProtectVirtualMemory    = (void*) 0x000243C4,
        .ZwReadVirtualMemory       = (void*) 0x00024798,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.160 (xpclnt_qfe.021108-2107)"),
      TEXT("BC5D15F5C30D4E8C849E0857971617334"),
      {
        .NtCreateProcess           = (void*) 0x000D45BE,
        .NtCreateProcessEx         = (void*) 0x000D4516,
        .NtCreateSection           = (void*) 0x000AF358,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D576C,
        .NtQueryInformationFile    = (void*) 0x00082014,
        .NtQueryKey                = (void*) 0x0012323A,
        .NtQueryValueKey           = (void*) 0x00120032,
        .NtSetInformationFile      = (void*) 0x00082604,
        .NtSetValueKey             = (void*) 0x001205F6,
        .ObpFreeObject             = (void*) 0x000C49FE,
        .PspTerminateProcess       = (void*) 0x000D58DE,
        .swprintf                  = (void*) 0x00053690,
        .ZwOpenProcess             = (void*) 0x000241FC,
        .ZwProtectVirtualMemory    = (void*) 0x00024328,
        .ZwReadVirtualMemory       = (void*) 0x000246FC,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.1106 (xpsp1.020828-1920)"),
      TEXT("656C04779CB54983AD8A6B57C363469C1"),
      {
        .NtCreateProcess           = (void*) 0x000E64E8,
        .NtCreateProcessEx         = (void*) 0x000E6440,
        .NtCreateSection           = (void*) 0x000C12A8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E7ACA,
        .NtQueryInformationFile    = (void*) 0x00093994,
        .NtQueryKey                = (void*) 0x00134954,
        .NtQueryValueKey           = (void*) 0x0013174E,
        .NtSetInformationFile      = (void*) 0x00093F40,
        .NtSetValueKey             = (void*) 0x00131D12,
        .ObpFreeObject             = (void*) 0x000D72B6,
        .PspTerminateProcess       = (void*) 0x000E7C3C,
        .swprintf                  = (void*) 0x0005A830,
        .ZwOpenProcess             = (void*) 0x000269C4,
        .ZwProtectVirtualMemory    = (void*) 0x00026AF0,
        .ZwReadVirtualMemory       = (void*) 0x00026EC4,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1106 (xpsp1.020828-1920)"),
      TEXT("EBC8148525684CCEBF8D3491B68F67211"),
      {
        .NtCreateProcess           = (void*) 0x000DCD3C,
        .NtCreateProcessEx         = (void*) 0x000DCC94,
        .NtCreateSection           = (void*) 0x000B6D42,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DE3A6,
        .NtQueryInformationFile    = (void*) 0x0008909A,
        .NtQueryKey                = (void*) 0x0012BAC6,
        .NtQueryValueKey           = (void*) 0x001288C0,
        .NtSetInformationFile      = (void*) 0x0008968A,
        .NtSetValueKey             = (void*) 0x00128E84,
        .ObpFreeObject             = (void*) 0x000CD280,
        .PspTerminateProcess       = (void*) 0x000DE518,
        .swprintf                  = (void*) 0x00057350,
        .ZwOpenProcess             = (void*) 0x00024C84,
        .ZwProtectVirtualMemory    = (void*) 0x00024DB0,
        .ZwReadVirtualMemory       = (void*) 0x00025184,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1106 (xpsp1.020828-1920)"),
      TEXT("C95EC79CFBFB4220AF2B6E9D09551A1F2"),
      {
        .NtCreateProcess           = (void*) 0x000DA8B3,
        .NtCreateProcessEx         = (void*) 0x000BC950,
        .NtCreateSection           = (void*) 0x000ABB92,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000BDC32,
        .NtQueryInformationFile    = (void*) 0x000B0514,
        .NtQueryKey                = (void*) 0x0009F460,
        .NtQueryValueKey           = (void*) 0x000AF3FB,
        .NtSetInformationFile      = (void*) 0x000BE589,
        .NtSetValueKey             = (void*) 0x0009E2DC,
        .ObpFreeObject             = (void*) 0x000AB072,
        .PspTerminateProcess       = (void*) 0x000F1EC6,
        .swprintf                  = (void*) 0x00023783,
        .ZwOpenProcess             = (void*) 0x0003B280,
        .ZwProtectVirtualMemory    = (void*) 0x0003B348,
        .ZwReadVirtualMemory       = (void*) 0x00064F44,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.1106 (xpsp1.020828-1920)"),
      TEXT("AAEF416AC44744F6B03A3B6259AE19881"),
      {
        .NtCreateProcess           = (void*) 0x000DD602,
        .NtCreateProcessEx         = (void*) 0x000DD55A,
        .NtCreateSection           = (void*) 0x000B8FEE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DEBF2,
        .NtQueryInformationFile    = (void*) 0x0008B986,
        .NtQueryKey                = (void*) 0x0012BA66,
        .NtQueryValueKey           = (void*) 0x00128860,
        .NtSetInformationFile      = (void*) 0x0008BF32,
        .NtSetValueKey             = (void*) 0x00128E24,
        .ObpFreeObject             = (void*) 0x000CE3BC,
        .PspTerminateProcess       = (void*) 0x000DED64,
        .swprintf                  = (void*) 0x00056E50,
        .ZwOpenProcess             = (void*) 0x00026888,
        .ZwProtectVirtualMemory    = (void*) 0x000269B4,
        .ZwReadVirtualMemory       = (void*) 0x00026D88,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1138 (xpsp2.020921-0842)"),
      TEXT("EEC98437B8C64C0AA9316EBFF14CCFE65"),
      {
        .NtCreateProcess           = (void*) 0x000DCF5A,
        .NtCreateProcessEx         = (void*) 0x000DCEB2,
        .NtCreateSection           = (void*) 0x000B6F3E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DE5C4,
        .NtQueryInformationFile    = (void*) 0x00089296,
        .NtQueryKey                = (void*) 0x0012BCE0,
        .NtQueryValueKey           = (void*) 0x00128ADA,
        .NtSetInformationFile      = (void*) 0x00089886,
        .NtSetValueKey             = (void*) 0x0012909E,
        .ObpFreeObject             = (void*) 0x000CD47C,
        .PspTerminateProcess       = (void*) 0x000DE736,
        .swprintf                  = (void*) 0x00057550,
        .ZwOpenProcess             = (void*) 0x00024E00,
        .ZwProtectVirtualMemory    = (void*) 0x00024F2C,
        .ZwReadVirtualMemory       = (void*) 0x00025300,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1138 (xpsp2.020921-0842)"),
      TEXT("AD5B6DD03E004D7BB0D355C42D29610E5"),
      {
        .NtCreateProcess           = (void*) 0x000D7198,
        .NtCreateProcessEx         = (void*) 0x000D70F0,
        .NtCreateSection           = (void*) 0x000B1D30,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D8802,
        .NtQueryInformationFile    = (void*) 0x00084296,
        .NtQueryKey                = (void*) 0x00125F14,
        .NtQueryValueKey           = (void*) 0x00122D0E,
        .NtSetInformationFile      = (void*) 0x00084886,
        .NtSetValueKey             = (void*) 0x001232D2,
        .ObpFreeObject             = (void*) 0x000C76C2,
        .PspTerminateProcess       = (void*) 0x000D8974,
        .swprintf                  = (void*) 0x00054350,
        .ZwOpenProcess             = (void*) 0x00024D58,
        .ZwProtectVirtualMemory    = (void*) 0x00024E84,
        .ZwReadVirtualMemory       = (void*) 0x00025258,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1144 (xpsp2.021108-1929)"),
      TEXT("6DE07FC8872C47D5B22D20387B7F44273"),
      {
        .NtCreateProcess           = (void*) 0x000DCE16,
        .NtCreateProcessEx         = (void*) 0x000DCD6E,
        .NtCreateSection           = (void*) 0x000B6E42,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DE480,
        .NtQueryInformationFile    = (void*) 0x0008919A,
        .NtQueryKey                = (void*) 0x0012BBA0,
        .NtQueryValueKey           = (void*) 0x0012899A,
        .NtSetInformationFile      = (void*) 0x0008978A,
        .NtSetValueKey             = (void*) 0x00128F5E,
        .ObpFreeObject             = (void*) 0x000CD380,
        .PspTerminateProcess       = (void*) 0x000DE5F2,
        .swprintf                  = (void*) 0x000574A0,
        .ZwOpenProcess             = (void*) 0x00024D78,
        .ZwProtectVirtualMemory    = (void*) 0x00024EA4,
        .ZwReadVirtualMemory       = (void*) 0x00025278,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1144 (xpsp2.021108-1929)"),
      TEXT("31EE89B5DDB24922BB190478A63817EF3"),
      {
        .NtCreateProcess           = (void*) 0x000D7060,
        .NtCreateProcessEx         = (void*) 0x000D6FB8,
        .NtCreateSection           = (void*) 0x000B1C30,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D86CA,
        .NtQueryInformationFile    = (void*) 0x0008419A,
        .NtQueryKey                = (void*) 0x00125DD8,
        .NtQueryValueKey           = (void*) 0x00122BD2,
        .NtSetInformationFile      = (void*) 0x0008478A,
        .NtSetValueKey             = (void*) 0x00123196,
        .ObpFreeObject             = (void*) 0x000C75C2,
        .PspTerminateProcess       = (void*) 0x000D883C,
        .swprintf                  = (void*) 0x000542A0,
        .ZwOpenProcess             = (void*) 0x00024CBC,
        .ZwProtectVirtualMemory    = (void*) 0x00024DE8,
        .ZwReadVirtualMemory       = (void*) 0x000251BC,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1149 (xpsp2.021108-1929)"),
      TEXT("6DE07FC8872C47D5B22D20387B7F44275"),
      {
        .NtCreateProcess           = (void*) 0x000DCE96,
        .NtCreateProcessEx         = (void*) 0x000DCDEE,
        .NtCreateSection           = (void*) 0x000B6EC2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DE500,
        .NtQueryInformationFile    = (void*) 0x0008921A,
        .NtQueryKey                = (void*) 0x0012BC34,
        .NtQueryValueKey           = (void*) 0x00128A2E,
        .NtSetInformationFile      = (void*) 0x0008980A,
        .NtSetValueKey             = (void*) 0x00128FF2,
        .ObpFreeObject             = (void*) 0x000CD400,
        .PspTerminateProcess       = (void*) 0x000DE672,
        .swprintf                  = (void*) 0x000574D0,
        .ZwOpenProcess             = (void*) 0x00024DA4,
        .ZwProtectVirtualMemory    = (void*) 0x00024ED0,
        .ZwReadVirtualMemory       = (void*) 0x000252A4,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1149 (xpsp2.021108-1929)"),
      TEXT("31EE89B5DDB24922BB190478A63817EF5"),
      {
        .NtCreateProcess           = (void*) 0x000D70E0,
        .NtCreateProcessEx         = (void*) 0x000D7038,
        .NtCreateSection           = (void*) 0x000B1CB0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D874A,
        .NtQueryInformationFile    = (void*) 0x0008421A,
        .NtQueryKey                = (void*) 0x00125E6C,
        .NtQueryValueKey           = (void*) 0x00122C66,
        .NtSetInformationFile      = (void*) 0x0008480A,
        .NtSetValueKey             = (void*) 0x0012322A,
        .ObpFreeObject             = (void*) 0x000C7642,
        .PspTerminateProcess       = (void*) 0x000D88BC,
        .swprintf                  = (void*) 0x000542C0,
        .ZwOpenProcess             = (void*) 0x00024CEC,
        .ZwProtectVirtualMemory    = (void*) 0x00024E18,
        .ZwReadVirtualMemory       = (void*) 0x000251EC,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1151 (xpsp2.030422-1633)"),
      TEXT("2080ED7B99A74CD9B8A12C69A916BE483"),
      {
        .NtCreateProcess           = (void*) 0x000DD23C,
        .NtCreateProcessEx         = (void*) 0x000DD194,
        .NtCreateSection           = (void*) 0x000B70C8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DE8A6,
        .NtQueryInformationFile    = (void*) 0x0008941A,
        .NtQueryKey                = (void*) 0x0012BFDA,
        .NtQueryValueKey           = (void*) 0x00128DD4,
        .NtSetInformationFile      = (void*) 0x00089A0A,
        .NtSetValueKey             = (void*) 0x00129398,
        .ObpFreeObject             = (void*) 0x000CD676,
        .PspTerminateProcess       = (void*) 0x000DEA18,
        .swprintf                  = (void*) 0x000575F0,
        .ZwOpenProcess             = (void*) 0x00024E14,
        .ZwProtectVirtualMemory    = (void*) 0x00024F40,
        .ZwReadVirtualMemory       = (void*) 0x00025314,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1151 (xpsp2.030422-1633)"),
      TEXT("FB1EDACE71FB4812A5D5132819D72E523"),
      {
        .NtCreateProcess           = (void*) 0x000D7486,
        .NtCreateProcessEx         = (void*) 0x000D73DE,
        .NtCreateSection           = (void*) 0x000B1EB6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D8AF0,
        .NtQueryInformationFile    = (void*) 0x0008441A,
        .NtQueryKey                = (void*) 0x00126212,
        .NtQueryValueKey           = (void*) 0x0012300C,
        .NtSetInformationFile      = (void*) 0x00084A0A,
        .NtSetValueKey             = (void*) 0x001235D0,
        .ObpFreeObject             = (void*) 0x000C78B8,
        .PspTerminateProcess       = (void*) 0x000D8C62,
        .swprintf                  = (void*) 0x000543E0,
        .ZwOpenProcess             = (void*) 0x00024D98,
        .ZwProtectVirtualMemory    = (void*) 0x00024EC4,
        .ZwReadVirtualMemory       = (void*) 0x00025298,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1251 (xpsp2.030721-1857)"),
      TEXT("87DD8639AC5345A79BD89603C7833EC21"),
      {
        .NtCreateProcess           = (void*) 0x000DDBE4,
        .NtCreateProcessEx         = (void*) 0x000DDB3C,
        .NtCreateSection           = (void*) 0x000B78B0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DF24E,
        .NtQueryInformationFile    = (void*) 0x00089C98,
        .NtQueryKey                = (void*) 0x0012C9E4,
        .NtQueryValueKey           = (void*) 0x001297DE,
        .NtSetInformationFile      = (void*) 0x0008A288,
        .NtSetValueKey             = (void*) 0x00129DA2,
        .ObpFreeObject             = (void*) 0x000CDF60,
        .PspTerminateProcess       = (void*) 0x000DF3C0,
        .swprintf                  = (void*) 0x00057E10,
        .ZwOpenProcess             = (void*) 0x00024E18,
        .ZwProtectVirtualMemory    = (void*) 0x00024F44,
        .ZwReadVirtualMemory       = (void*) 0x00025318,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1251 (xpsp2.030721-1857)"),
      TEXT("B9D1DA6CDD1846DAA468C6910C896F391"),
      {
        .NtCreateProcess           = (void*) 0x000D8090,
        .NtCreateProcessEx         = (void*) 0x000D7FE8,
        .NtCreateSection           = (void*) 0x000B28D4,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000D96FA,
        .NtQueryInformationFile    = (void*) 0x00084E98,
        .NtQueryKey                = (void*) 0x00126E94,
        .NtQueryValueKey           = (void*) 0x00123C8E,
        .NtSetInformationFile      = (void*) 0x00085488,
        .NtSetValueKey             = (void*) 0x00124252,
        .ObpFreeObject             = (void*) 0x000C840C,
        .PspTerminateProcess       = (void*) 0x000D986C,
        .swprintf                  = (void*) 0x00054DA0,
        .ZwOpenProcess             = (void*) 0x00024D84,
        .ZwProtectVirtualMemory    = (void*) 0x00024EB0,
        .ZwReadVirtualMemory       = (void*) 0x00025284,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.1605 (xpsp2.040919-1003)"),
      TEXT("5B1319B655B34CA7BC1AF71D96BDBE384"),
      {
        .NtCreateProcess           = (void*) 0x000E785A,
        .NtCreateProcessEx         = (void*) 0x000E77B2,
        .NtCreateSection           = (void*) 0x000C222A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E8E3C,
        .NtQueryInformationFile    = (void*) 0x000949B8,
        .NtQueryKey                = (void*) 0x0013601E,
        .NtQueryValueKey           = (void*) 0x00132E18,
        .NtSetInformationFile      = (void*) 0x00094F64,
        .NtSetValueKey             = (void*) 0x001333DC,
        .ObpFreeObject             = (void*) 0x000D8366,
        .PspTerminateProcess       = (void*) 0x000E8FAE,
        .swprintf                  = (void*) 0x0005BA90,
        .ZwOpenProcess             = (void*) 0x00026F50,
        .ZwProtectVirtualMemory    = (void*) 0x0002707C,
        .ZwReadVirtualMemory       = (void*) 0x00027450,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1605 (xpsp2.040919-1003)"),
      TEXT("86DDFCA28A1C44E9B068666F81AACCD34"),
      {
        .NtCreateProcess           = (void*) 0x000DE45E,
        .NtCreateProcessEx         = (void*) 0x000DE3B6,
        .NtCreateSection           = (void*) 0x000B8058,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFABA,
        .NtQueryInformationFile    = (void*) 0x0008A43E,
        .NtQueryKey                = (void*) 0x0012D530,
        .NtQueryValueKey           = (void*) 0x0012A32A,
        .NtSetInformationFile      = (void*) 0x0008AA2E,
        .NtSetValueKey             = (void*) 0x0012A8EE,
        .ObpFreeObject             = (void*) 0x000CE6D4,
        .PspTerminateProcess       = (void*) 0x000DFC2C,
        .swprintf                  = (void*) 0x00058560,
        .ZwOpenProcess             = (void*) 0x000251F0,
        .ZwProtectVirtualMemory    = (void*) 0x0002531C,
        .ZwReadVirtualMemory       = (void*) 0x000256F0,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1605 (xpsp2.040919-1003)"),
      TEXT("E5465483EB2E4B5E9C35AC633A66377A2"),
      {
        .NtCreateProcess           = (void*) 0x000D995B,
        .NtCreateProcessEx         = (void*) 0x000ABB01,
        .NtCreateSection           = (void*) 0x00082366,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ACFFF,
        .NtQueryInformationFile    = (void*) 0x00096985,
        .NtQueryKey                = (void*) 0x0009A305,
        .NtQueryValueKey           = (void*) 0x0008E07F,
        .NtSetInformationFile      = (void*) 0x0008B825,
        .NtSetValueKey             = (void*) 0x000A44F6,
        .ObpFreeObject             = (void*) 0x00080F89,
        .PspTerminateProcess       = (void*) 0x000FE029,
        .swprintf                  = (void*) 0x00020BC5,
        .ZwOpenProcess             = (void*) 0x00005AA0,
        .ZwProtectVirtualMemory    = (void*) 0x00005BFE,
        .ZwReadVirtualMemory       = (void*) 0x00006059,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.1605 (xpsp2.040919-1003)"),
      TEXT("D9017BEDA05045C7AAEF1D639B5F01B44"),
      {
        .NtCreateProcess           = (void*) 0x000DF9C4,
        .NtCreateProcessEx         = (void*) 0x000DF91C,
        .NtCreateSection           = (void*) 0x000BAFA2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0FA6,
        .NtQueryInformationFile    = (void*) 0x0008D9A8,
        .NtQueryKey                = (void*) 0x0012E1A4,
        .NtQueryValueKey           = (void*) 0x0012AF9E,
        .NtSetInformationFile      = (void*) 0x0008DF54,
        .NtSetValueKey             = (void*) 0x0012B562,
        .ObpFreeObject             = (void*) 0x000D04CC,
        .PspTerminateProcess       = (void*) 0x000E1118,
        .swprintf                  = (void*) 0x000582A0,
        .ZwOpenProcess             = (void*) 0x00026E1C,
        .ZwProtectVirtualMemory    = (void*) 0x00026F48,
        .ZwReadVirtualMemory       = (void*) 0x0002731C,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.1634 (xpsp2.050301-1526)"),
      TEXT("AD2CF35277144B7CA76B695F8A7946241"),
      {
        .NtCreateProcess           = (void*) 0x000E7862,
        .NtCreateProcessEx         = (void*) 0x000E77BA,
        .NtCreateSection           = (void*) 0x000C222A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E8E44,
        .NtQueryInformationFile    = (void*) 0x000949B8,
        .NtQueryKey                = (void*) 0x00136018,
        .NtQueryValueKey           = (void*) 0x00132E12,
        .NtSetInformationFile      = (void*) 0x00094F64,
        .NtSetValueKey             = (void*) 0x001333D6,
        .ObpFreeObject             = (void*) 0x000D8366,
        .PspTerminateProcess       = (void*) 0x000E8FB6,
        .swprintf                  = (void*) 0x0005BA90,
        .ZwOpenProcess             = (void*) 0x00026F50,
        .ZwProtectVirtualMemory    = (void*) 0x0002707C,
        .ZwReadVirtualMemory       = (void*) 0x00027450,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.1634 (xpsp2.050301-1526)"),
      TEXT("4F10E20499CD454DA4E958DC6B7DC6151"),
      {
        .NtCreateProcess           = (void*) 0x000DE466,
        .NtCreateProcessEx         = (void*) 0x000DE3BE,
        .NtCreateSection           = (void*) 0x000B8058,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000DFAC2,
        .NtQueryInformationFile    = (void*) 0x0008A43E,
        .NtQueryKey                = (void*) 0x0012D52A,
        .NtQueryValueKey           = (void*) 0x0012A324,
        .NtSetInformationFile      = (void*) 0x0008AA2E,
        .NtSetValueKey             = (void*) 0x0012A8E8,
        .ObpFreeObject             = (void*) 0x000CE6D4,
        .PspTerminateProcess       = (void*) 0x000DFC34,
        .swprintf                  = (void*) 0x00058560,
        .ZwOpenProcess             = (void*) 0x000251F0,
        .ZwProtectVirtualMemory    = (void*) 0x0002531C,
        .ZwReadVirtualMemory       = (void*) 0x000256F0,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.1634 (xpsp2.050301-1526)"),
      TEXT("8C0365A4579D46469E0B53A80062C0472"),
      {
        .NtCreateProcess           = (void*) 0x000D3DCD,
        .NtCreateProcessEx         = (void*) 0x000A0107,
        .NtCreateSection           = (void*) 0x0007ECC9,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000A156E,
        .NtQueryInformationFile    = (void*) 0x000932EE,
        .NtQueryKey                = (void*) 0x00096734,
        .NtQueryValueKey           = (void*) 0x0008A214,
        .NtSetInformationFile      = (void*) 0x00087FCF,
        .NtSetValueKey             = (void*) 0x000A5C94,
        .ObpFreeObject             = (void*) 0x0007D9A5,
        .PspTerminateProcess       = (void*) 0x000F779C,
        .swprintf                  = (void*) 0x0001F96F,
        .ZwOpenProcess             = (void*) 0x00005682,
        .ZwProtectVirtualMemory    = (void*) 0x000057AE,
        .ZwReadVirtualMemory       = (void*) 0x00005B82,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.1634 (xpsp2.050301-1526)"),
      TEXT("49D26357C4BC4C9699A5260C5758DCCE1"),
      {
        .NtCreateProcess           = (void*) 0x000DF9CC,
        .NtCreateProcessEx         = (void*) 0x000DF924,
        .NtCreateSection           = (void*) 0x000BAFA2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000E0FAE,
        .NtQueryInformationFile    = (void*) 0x0008D9A8,
        .NtQueryKey                = (void*) 0x0012E19E,
        .NtQueryValueKey           = (void*) 0x0012AF98,
        .NtSetInformationFile      = (void*) 0x0008DF54,
        .NtSetValueKey             = (void*) 0x0012B55C,
        .ObpFreeObject             = (void*) 0x000D04CC,
        .PspTerminateProcess       = (void*) 0x000E1120,
        .swprintf                  = (void*) 0x000582A0,
        .ZwOpenProcess             = (void*) 0x00026E1C,
        .ZwProtectVirtualMemory    = (void*) 0x00026F48,
        .ZwReadVirtualMemory       = (void*) 0x0002731C,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)"),
      TEXT("3FD0C106E6C64D489CB5408DE20BB2A31"),
      {
        .NtCreateProcess           = (void*) 0x000EDFAC,
        .NtCreateProcessEx         = (void*) 0x000EDEF6,
        .NtCreateSection           = (void*) 0x000C7116,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EF774,
        .NtQueryInformationFile    = (void*) 0x00096A02,
        .NtQueryKey                = (void*) 0x00142206,
        .NtQueryValueKey           = (void*) 0x0013EC46,
        .NtSetInformationFile      = (void*) 0x00097006,
        .NtSetValueKey             = (void*) 0x0013F24C,
        .ObpFreeObject             = (void*) 0x000DD502,
        .PspTerminateProcess       = (void*) 0x000EF8EE,
        .swprintf                  = (void*) 0x0005ED65,
        .ZwOpenProcess             = (void*) 0x000269E8,
        .ZwProtectVirtualMemory    = (void*) 0x00026B14,
        .ZwReadVirtualMemory       = (void*) 0x00026EE8,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2096 (xpsp_sp2_rc1.040311-2315)"),
      TEXT("9996D1AF67964E6A947A9EA33EC8B9112"),
      {
        .NtCreateProcess           = (void*) 0x000D4928,
        .NtCreateProcessEx         = (void*) 0x000B3866,
        .NtCreateSection           = (void*) 0x0009BA48,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x00100121,
        .NtQueryInformationFile    = (void*) 0x00099828,
        .NtQueryKey                = (void*) 0x000980D1,
        .NtQueryValueKey           = (void*) 0x0008F4CA,
        .NtSetInformationFile      = (void*) 0x0009A46B,
        .NtSetValueKey             = (void*) 0x000A0C64,
        .ObpFreeObject             = (void*) 0x0008C88D,
        .PspTerminateProcess       = (void*) 0x001557CE,
        .swprintf                  = (void*) 0x00020898,
        .ZwOpenProcess             = (void*) 0x000072BE,
        .ZwProtectVirtualMemory    = (void*) 0x0000741C,
        .ZwReadVirtualMemory       = (void*) 0x00007877,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2149 (xpsp_sp2_rc2.040610-1520)"),
      TEXT("BF484640AF2249E5B9024220F47FC8071"),
      {
        .NtCreateProcess           = (void*) 0x000EE568,
        .NtCreateProcessEx         = (void*) 0x000EE4B2,
        .NtCreateSection           = (void*) 0x000C7ABE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000EFD4A,
        .NtQueryInformationFile    = (void*) 0x00097396,
        .NtQueryKey                = (void*) 0x00142A7A,
        .NtQueryValueKey           = (void*) 0x0013F4BA,
        .NtSetInformationFile      = (void*) 0x0009799A,
        .NtSetValueKey             = (void*) 0x0013FAC0,
        .ObpFreeObject             = (void*) 0x000DDA92,
        .PspTerminateProcess       = (void*) 0x000EFEC4,
        .swprintf                  = (void*) 0x0005F4A5,
        .ZwOpenProcess             = (void*) 0x00026C28,
        .ZwProtectVirtualMemory    = (void*) 0x00026D54,
        .ZwReadVirtualMemory       = (void*) 0x00027128,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2149 (xpsp_sp2_rc2.040610-1520)"),
      TEXT("4B9A9350E82F4127864C8961EC3B77E22"),
      {
        .NtCreateProcess           = (void*) 0x000DC1AA,
        .NtCreateProcessEx         = (void*) 0x000B237E,
        .NtCreateSection           = (void*) 0x000A3251,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B369B,
        .NtQueryInformationFile    = (void*) 0x0009C247,
        .NtQueryKey                = (void*) 0x0009AA79,
        .NtQueryValueKey           = (void*) 0x000925E0,
        .NtSetInformationFile      = (void*) 0x00097610,
        .NtSetValueKey             = (void*) 0x000A99AA,
        .ObpFreeObject             = (void*) 0x0008CAE8,
        .PspTerminateProcess       = (void*) 0x00156380,
        .swprintf                  = (void*) 0x000227EE,
        .ZwOpenProcess             = (void*) 0x00006BAA,
        .ZwProtectVirtualMemory    = (void*) 0x00006D08,
        .ZwReadVirtualMemory       = (void*) 0x00007163,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"),
      TEXT("BD8F451F3E754ED8A34B50560CEB08E31"),
      {
        .NtCreateProcess           = (void*) 0x000EECE8,
        .NtCreateProcessEx         = (void*) 0x000EEC32,
        .NtCreateSection           = (void*) 0x000C823E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04C8,
        .NtQueryInformationFile    = (void*) 0x00097B16,
        .NtQueryKey                = (void*) 0x0014328C,
        .NtQueryValueKey           = (void*) 0x0013FC8C,
        .NtSetInformationFile      = (void*) 0x0009811A,
        .NtSetValueKey             = (void*) 0x00140292,
        .ObpFreeObject             = (void*) 0x000DE212,
        .PspTerminateProcess       = (void*) 0x000F0642,
        .swprintf                  = (void*) 0x0005FBA5,
        .ZwOpenProcess             = (void*) 0x00026BFC,
        .ZwProtectVirtualMemory    = (void*) 0x00026D28,
        .ZwReadVirtualMemory       = (void*) 0x000270FC,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"),
      TEXT("7DE39A3E89DA4B378B95A09FA3A6398C2"),
      {
        .NtCreateProcess           = (void*) 0x000DDA28,
        .NtCreateProcessEx         = (void*) 0x000B45EC,
        .NtCreateSection           = (void*) 0x00097E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5E75,
        .NtQueryInformationFile    = (void*) 0x000A9C35,
        .NtQueryKey                = (void*) 0x000A329E,
        .NtQueryValueKey           = (void*) 0x0009D361,
        .NtSetInformationFile      = (void*) 0x000AB2C9,
        .NtSetValueKey             = (void*) 0x000AD921,
        .ObpFreeObject             = (void*) 0x00097640,
        .PspTerminateProcess       = (void*) 0x0015F016,
        .swprintf                  = (void*) 0x000236A5,
        .ZwOpenProcess             = (void*) 0x0000D110,
        .ZwProtectVirtualMemory    = (void*) 0x0000D26E,
        .ZwReadVirtualMemory       = (void*) 0x0000D6C9,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"),
      TEXT("C40DD53A8D3D4AE3A24CE6BE866649C91"),
      {
        .NtCreateProcess           = (void*) 0x000F8A1C,
        .NtCreateProcessEx         = (void*) 0x000F8966,
        .NtCreateSection           = (void*) 0x000D2DEE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA170,
        .NtQueryInformationFile    = (void*) 0x000A27F8,
        .NtQueryKey                = (void*) 0x0014C702,
        .NtQueryValueKey           = (void*) 0x00149102,
        .NtSetInformationFile      = (void*) 0x000A2DC4,
        .NtSetValueKey             = (void*) 0x00149708,
        .ObpFreeObject             = (void*) 0x000E874E,
        .PspTerminateProcess       = (void*) 0x000FA2EA,
        .swprintf                  = (void*) 0x00063635,
        .ZwOpenProcess             = (void*) 0x00028A28,
        .ZwProtectVirtualMemory    = (void*) 0x00028B54,
        .ZwReadVirtualMemory       = (void*) 0x00028F28,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"),
      TEXT("8592B6763F34476B9BB560395A383F962"),
      {
        .NtCreateProcess           = (void*) 0x000DC543,
        .NtCreateProcessEx         = (void*) 0x000B15D3,
        .NtCreateSection           = (void*) 0x0008DB1B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B3E1E,
        .NtQueryInformationFile    = (void*) 0x0009BD12,
        .NtQueryKey                = (void*) 0x00098473,
        .NtQueryValueKey           = (void*) 0x000949A8,
        .NtSetInformationFile      = (void*) 0x000A2E7E,
        .NtSetValueKey             = (void*) 0x0009E527,
        .ObpFreeObject             = (void*) 0x0008CEA0,
        .PspTerminateProcess       = (void*) 0x00155BC2,
        .swprintf                  = (void*) 0x0002043A,
        .ZwOpenProcess             = (void*) 0x00006724,
        .ZwProtectVirtualMemory    = (void*) 0x00006882,
        .ZwReadVirtualMemory       = (void*) 0x00006CDD,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2507 (xpsp.040806-1825)"),
      TEXT("D3C6623EA2154FF3B7FE7B5650EA03462"),
      {
        .NtCreateProcess           = (void*) 0x000EECD4,
        .NtCreateProcessEx         = (void*) 0x000EEC1E,
        .NtCreateSection           = (void*) 0x000C822A,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04B4,
        .NtQueryInformationFile    = (void*) 0x00097B16,
        .NtQueryKey                = (void*) 0x00143278,
        .NtQueryValueKey           = (void*) 0x0013FC78,
        .NtSetInformationFile      = (void*) 0x0009811A,
        .NtSetValueKey             = (void*) 0x0014027E,
        .ObpFreeObject             = (void*) 0x000DE1FE,
        .PspTerminateProcess       = (void*) 0x000F062E,
        .swprintf                  = (void*) 0x0005FBA5,
        .ZwOpenProcess             = (void*) 0x00026BFC,
        .ZwProtectVirtualMemory    = (void*) 0x00026D28,
        .ZwReadVirtualMemory       = (void*) 0x000270FC,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2507 (xpsp.040806-1825)"),
      TEXT("F9574CF72DB743B1AEBBF083CF6CD5832"),
      {
        .NtCreateProcess           = (void*) 0x000D6D1B,
        .NtCreateProcessEx         = (void*) 0x000A8EBB,
        .NtCreateSection           = (void*) 0x0008DA1B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AB6CE,
        .NtQueryInformationFile    = (void*) 0x000988AA,
        .NtQueryKey                = (void*) 0x0009DB67,
        .NtQueryValueKey           = (void*) 0x00093351,
        .NtSetInformationFile      = (void*) 0x000AF4FD,
        .NtSetValueKey             = (void*) 0x0009B0BF,
        .ObpFreeObject             = (void*) 0x0008CDA0,
        .PspTerminateProcess       = (void*) 0x00155AAA,
        .swprintf                  = (void*) 0x0001E00E,
        .ZwOpenProcess             = (void*) 0x00006724,
        .ZwProtectVirtualMemory    = (void*) 0x00006882,
        .ZwReadVirtualMemory       = (void*) 0x00006CDD,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2573 (xpsp.041130-1728)"),
      TEXT("22D47F5E8FB544849C55A3267A02F7AB1"),
      {
        .NtCreateProcess           = (void*) 0x000EED06,
        .NtCreateProcessEx         = (void*) 0x000EEC50,
        .NtCreateSection           = (void*) 0x000C822E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04E6,
        .NtQueryInformationFile    = (void*) 0x00097B16,
        .NtQueryKey                = (void*) 0x001432AA,
        .NtQueryValueKey           = (void*) 0x0013FCAA,
        .NtSetInformationFile      = (void*) 0x0009811A,
        .NtSetValueKey             = (void*) 0x001402B0,
        .ObpFreeObject             = (void*) 0x000DE202,
        .PspTerminateProcess       = (void*) 0x000F0660,
        .swprintf                  = (void*) 0x0005FBA5,
        .ZwOpenProcess             = (void*) 0x00026BFC,
        .ZwProtectVirtualMemory    = (void*) 0x00026D28,
        .ZwReadVirtualMemory       = (void*) 0x000270FC,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2573 (xpsp.041130-1728)"),
      TEXT("1BFC5047E16A49D483AA4F6AD131AE7D2"),
      {
        .NtCreateProcess           = (void*) 0x000D633C,
        .NtCreateProcessEx         = (void*) 0x000A9432,
        .NtCreateSection           = (void*) 0x0008D41B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABC43,
        .NtQueryInformationFile    = (void*) 0x0009B422,
        .NtQueryKey                = (void*) 0x00097B87,
        .NtQueryValueKey           = (void*) 0x000940BB,
        .NtSetInformationFile      = (void*) 0x000A0E44,
        .NtSetValueKey             = (void*) 0x0009DC35,
        .ObpFreeObject             = (void*) 0x0008C7A1,
        .PspTerminateProcess       = (void*) 0x001554F6,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)"),
      TEXT("430480FAAC4F4A45980B99443EDC145E1"),
      {
        .NtCreateProcess           = (void*) 0x000F8A1C,
        .NtCreateProcessEx         = (void*) 0x000F8966,
        .NtCreateSection           = (void*) 0x000D2DE6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA16E,
        .NtQueryInformationFile    = (void*) 0x000A27E2,
        .NtQueryKey                = (void*) 0x0014C708,
        .NtQueryValueKey           = (void*) 0x00149108,
        .NtSetInformationFile      = (void*) 0x000A2DAE,
        .NtSetValueKey             = (void*) 0x0014970E,
        .ObpFreeObject             = (void*) 0x000E8746,
        .PspTerminateProcess       = (void*) 0x000FA2E8,
        .swprintf                  = (void*) 0x00063635,
        .ZwOpenProcess             = (void*) 0x00028A28,
        .ZwProtectVirtualMemory    = (void*) 0x00028B54,
        .ZwReadVirtualMemory       = (void*) 0x00028F28,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)"),
      TEXT("89C2A9EB56A74E2D8269AFD1D835BA331"),
      {
        .NtCreateProcess           = (void*) 0x000EECC6,
        .NtCreateProcessEx         = (void*) 0x000EEC10,
        .NtCreateSection           = (void*) 0x000C8222,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04A6,
        .NtQueryInformationFile    = (void*) 0x00097B00,
        .NtQueryKey                = (void*) 0x00143294,
        .NtQueryValueKey           = (void*) 0x0013FC94,
        .NtSetInformationFile      = (void*) 0x00098104,
        .NtSetValueKey             = (void*) 0x0014029A,
        .ObpFreeObject             = (void*) 0x000DE1F6,
        .PspTerminateProcess       = (void*) 0x000F0620,
        .swprintf                  = (void*) 0x0005FBA5,
        .ZwOpenProcess             = (void*) 0x00026BFC,
        .ZwProtectVirtualMemory    = (void*) 0x00026D28,
        .ZwReadVirtualMemory       = (void*) 0x000270FC,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)"),
      TEXT("32962337F0F646388B39535CD8DD70E82"),
      {
        .NtCreateProcess           = (void*) 0x000D6314,
        .NtCreateProcessEx         = (void*) 0x000A941A,
        .NtCreateSection           = (void*) 0x0008D41B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABC2B,
        .NtQueryInformationFile    = (void*) 0x0009B40A,
        .NtQueryKey                = (void*) 0x00097B71,
        .NtQueryValueKey           = (void*) 0x000940BB,
        .NtSetInformationFile      = (void*) 0x000A0E2C,
        .NtSetValueKey             = (void*) 0x0009DC1D,
        .ObpFreeObject             = (void*) 0x0008C7A1,
        .PspTerminateProcess       = (void*) 0x001554A6,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2622 (xpsp_sp2_gdr.050301-1519)"),
      TEXT("AA1EE1B2A63A4232A379F3EFDDC4CFE82"),
      {
        .NtCreateProcess           = (void*) 0x000DD0C0,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015CFF8,
        .swprintf                  = (void*) 0x0002388A,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2622 (xpsp.050301-1521)"),
      TEXT("EE13F4FFB97343489F63767D2E72F4741"),
      {
        .NtCreateProcess           = (void*) 0x000F8A3A,
        .NtCreateProcessEx         = (void*) 0x000F8984,
        .NtCreateSection           = (void*) 0x000D2DD6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA18C,
        .NtQueryInformationFile    = (void*) 0x000A27E2,
        .NtQueryKey                = (void*) 0x0014C726,
        .NtQueryValueKey           = (void*) 0x00149126,
        .NtSetInformationFile      = (void*) 0x000A2DAE,
        .NtSetValueKey             = (void*) 0x0014972C,
        .ObpFreeObject             = (void*) 0x000E8736,
        .PspTerminateProcess       = (void*) 0x000FA306,
        .swprintf                  = (void*) 0x00063645,
        .ZwOpenProcess             = (void*) 0x00028A3C,
        .ZwProtectVirtualMemory    = (void*) 0x00028B68,
        .ZwReadVirtualMemory       = (void*) 0x00028F3C,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2622 (xpsp.050301-1521)"),
      TEXT("8FB67EFA263E45C4BEF1AC0748EC9EB01"),
      {
        .NtCreateProcess           = (void*) 0x000EECE4,
        .NtCreateProcessEx         = (void*) 0x000EEC2E,
        .NtCreateSection           = (void*) 0x000C8212,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04C4,
        .NtQueryInformationFile    = (void*) 0x00097B00,
        .NtQueryKey                = (void*) 0x001432B2,
        .NtQueryValueKey           = (void*) 0x0013FCB2,
        .NtSetInformationFile      = (void*) 0x00098104,
        .NtSetValueKey             = (void*) 0x001402B8,
        .ObpFreeObject             = (void*) 0x000DE1E6,
        .PspTerminateProcess       = (void*) 0x000F063E,
        .swprintf                  = (void*) 0x0005FBB5,
        .ZwOpenProcess             = (void*) 0x00026C10,
        .ZwProtectVirtualMemory    = (void*) 0x00026D3C,
        .ZwReadVirtualMemory       = (void*) 0x00027110,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2622 (xpsp.050301-1521)"),
      TEXT("012E81B8E0724418A1E96DD7F1C5CB9F2"),
      {
        .NtCreateProcess           = (void*) 0x000D633C,
        .NtCreateProcessEx         = (void*) 0x000A941A,
        .NtCreateSection           = (void*) 0x0008D41B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABC2B,
        .NtQueryInformationFile    = (void*) 0x0009B40A,
        .NtQueryKey                = (void*) 0x00097B71,
        .NtQueryValueKey           = (void*) 0x000940BB,
        .NtSetInformationFile      = (void*) 0x000A0E2C,
        .NtSetValueKey             = (void*) 0x0009DC1D,
        .ObpFreeObject             = (void*) 0x0008C7A1,
        .PspTerminateProcess       = (void*) 0x001554FA,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2622 (xpsp.050301-1521)"),
      TEXT("1F623A3A03514FBA84802D392AFDDE182"),
      {
        .NtCreateProcess           = (void*) 0x000DD0A8,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D026,
        .swprintf                  = (void*) 0x0002387A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2643 (xpsp.050329-1536)"),
      TEXT("F34F1BF50056422FB0FE176944516D4A1"),
      {
        .NtCreateProcess           = (void*) 0x000F8A3A,
        .NtCreateProcessEx         = (void*) 0x000F8984,
        .NtCreateSection           = (void*) 0x000D2DD6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA18C,
        .NtQueryInformationFile    = (void*) 0x000A27E2,
        .NtQueryKey                = (void*) 0x0014C726,
        .NtQueryValueKey           = (void*) 0x00149126,
        .NtSetInformationFile      = (void*) 0x000A2DAE,
        .NtSetValueKey             = (void*) 0x0014972C,
        .ObpFreeObject             = (void*) 0x000E8736,
        .PspTerminateProcess       = (void*) 0x000FA306,
        .swprintf                  = (void*) 0x00063645,
        .ZwOpenProcess             = (void*) 0x00028A3C,
        .ZwProtectVirtualMemory    = (void*) 0x00028B68,
        .ZwReadVirtualMemory       = (void*) 0x00028F3C,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2643 (xpsp.050329-1536)"),
      TEXT("6CB8826CEEE24F4A88484F5DAA09A6E11"),
      {
        .NtCreateProcess           = (void*) 0x000EECE4,
        .NtCreateProcessEx         = (void*) 0x000EEC2E,
        .NtCreateSection           = (void*) 0x000C8212,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04C4,
        .NtQueryInformationFile    = (void*) 0x00097B00,
        .NtQueryKey                = (void*) 0x001432B2,
        .NtQueryValueKey           = (void*) 0x0013FCB2,
        .NtSetInformationFile      = (void*) 0x00098104,
        .NtSetValueKey             = (void*) 0x001402B8,
        .ObpFreeObject             = (void*) 0x000DE1E6,
        .PspTerminateProcess       = (void*) 0x000F063E,
        .swprintf                  = (void*) 0x0005FBB5,
        .ZwOpenProcess             = (void*) 0x00026C10,
        .ZwProtectVirtualMemory    = (void*) 0x00026D3C,
        .ZwReadVirtualMemory       = (void*) 0x00027110,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2643 (xpsp.050329-1536)"),
      TEXT("9F2528E50F6E473796E007462C77D4E82"),
      {
        .NtCreateProcess           = (void*) 0x000D633C,
        .NtCreateProcessEx         = (void*) 0x000A941A,
        .NtCreateSection           = (void*) 0x0008D41B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABC2B,
        .NtQueryInformationFile    = (void*) 0x0009B40A,
        .NtQueryKey                = (void*) 0x00097B71,
        .NtQueryValueKey           = (void*) 0x000940BB,
        .NtSetInformationFile      = (void*) 0x000A0E2C,
        .NtSetValueKey             = (void*) 0x0009DC1D,
        .ObpFreeObject             = (void*) 0x0008C7A1,
        .PspTerminateProcess       = (void*) 0x001554FA,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2643 (xpsp.050329-1536)"),
      TEXT("8A840CDB24D446469499CC12974C0D322"),
      {
        .NtCreateProcess           = (void*) 0x000DD0A8,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D026,
        .swprintf                  = (void*) 0x0002387A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2670 (xpsp.050504-1703)"),
      TEXT("02EDF4F0DCB84D8CB8F8DD0DEED32A121"),
      {
        .NtCreateProcess           = (void*) 0x000EED00,
        .NtCreateProcessEx         = (void*) 0x000EEC4A,
        .NtCreateSection           = (void*) 0x000C822E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F04E0,
        .NtQueryInformationFile    = (void*) 0x00097B1C,
        .NtQueryKey                = (void*) 0x001432E4,
        .NtQueryValueKey           = (void*) 0x0013FCE4,
        .NtSetInformationFile      = (void*) 0x00098120,
        .NtSetValueKey             = (void*) 0x001402EA,
        .ObpFreeObject             = (void*) 0x000DE202,
        .PspTerminateProcess       = (void*) 0x000F065A,
        .swprintf                  = (void*) 0x0005FBB5,
        .ZwOpenProcess             = (void*) 0x00026C10,
        .ZwProtectVirtualMemory    = (void*) 0x00026D3C,
        .ZwReadVirtualMemory       = (void*) 0x00027110,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2670 (xpsp.050504-1703)"),
      TEXT("7B85A57143994DADBECA27768E3068982"),
      {
        .NtCreateProcess           = (void*) 0x000D632C,
        .NtCreateProcessEx         = (void*) 0x000A941A,
        .NtCreateSection           = (void*) 0x0008D41B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABC2B,
        .NtQueryInformationFile    = (void*) 0x0009B40A,
        .NtQueryKey                = (void*) 0x00097B71,
        .NtQueryValueKey           = (void*) 0x000940BB,
        .NtSetInformationFile      = (void*) 0x000A0E2C,
        .NtSetValueKey             = (void*) 0x0009DC1D,
        .ObpFreeObject             = (void*) 0x0008C7A1,
        .PspTerminateProcess       = (void*) 0x00155552,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2705 (xpsp.050622-1524)"),
      TEXT("1BBE06CABB4C4965B304101D416846321"),
      {
        .NtCreateProcess           = (void*) 0x000F8A56,
        .NtCreateProcessEx         = (void*) 0x000F89A0,
        .NtCreateSection           = (void*) 0x000D2DF2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA1A8,
        .NtQueryInformationFile    = (void*) 0x000A27FE,
        .NtQueryKey                = (void*) 0x0014C758,
        .NtQueryValueKey           = (void*) 0x00149158,
        .NtSetInformationFile      = (void*) 0x000A2DCA,
        .NtSetValueKey             = (void*) 0x0014975E,
        .ObpFreeObject             = (void*) 0x000E8752,
        .PspTerminateProcess       = (void*) 0x000FA322,
        .swprintf                  = (void*) 0x000637B5,
        .ZwOpenProcess             = (void*) 0x00028B0C,
        .ZwProtectVirtualMemory    = (void*) 0x00028C38,
        .ZwReadVirtualMemory       = (void*) 0x0002900C,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2705 (xpsp.050622-1524)"),
      TEXT("46BA5C69C3A2424D99AE8F7B790630C82"),
      {
        .NtCreateProcess           = (void*) 0x000DD0A8,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D07E,
        .swprintf                  = (void*) 0x0002655A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2765 (xpsp.050928-1517)"),
      TEXT("93B3151FBA1F444E921B0B7AF2BADA5A1"),
      {
        .NtCreateProcess           = (void*) 0x000F8A56,
        .NtCreateProcessEx         = (void*) 0x000F89A0,
        .NtCreateSection           = (void*) 0x000D2DF2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA1A8,
        .NtQueryInformationFile    = (void*) 0x000A27FE,
        .NtQueryKey                = (void*) 0x0014C758,
        .NtQueryValueKey           = (void*) 0x00149158,
        .NtSetInformationFile      = (void*) 0x000A2DCA,
        .NtSetValueKey             = (void*) 0x0014975E,
        .ObpFreeObject             = (void*) 0x000E8752,
        .PspTerminateProcess       = (void*) 0x000FA322,
        .swprintf                  = (void*) 0x000637B5,
        .ZwOpenProcess             = (void*) 0x00028B0C,
        .ZwProtectVirtualMemory    = (void*) 0x00028C38,
        .ZwReadVirtualMemory       = (void*) 0x0002900C,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2765 (xpsp.050928-1517)"),
      TEXT("CC2DE018A01244D4832AF532340DCAC41"),
      {
        .NtCreateProcess           = (void*) 0x000EEE80,
        .NtCreateProcessEx         = (void*) 0x000EEDCA,
        .NtCreateSection           = (void*) 0x000C83AE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0660,
        .NtQueryInformationFile    = (void*) 0x00097C9C,
        .NtQueryKey                = (void*) 0x00143464,
        .NtQueryValueKey           = (void*) 0x0013FE64,
        .NtSetInformationFile      = (void*) 0x000982A0,
        .NtSetValueKey             = (void*) 0x0014046A,
        .ObpFreeObject             = (void*) 0x000DE382,
        .PspTerminateProcess       = (void*) 0x000F07DA,
        .swprintf                  = (void*) 0x0005FCF5,
        .ZwOpenProcess             = (void*) 0x00026D28,
        .ZwProtectVirtualMemory    = (void*) 0x00026E54,
        .ZwReadVirtualMemory       = (void*) 0x00027228,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2765 (xpsp.050928-1517)"),
      TEXT("7DEB5F662C1B4675A79BE082B317F5402"),
      {
        .NtCreateProcess           = (void*) 0x000D64AC,
        .NtCreateProcessEx         = (void*) 0x000A959A,
        .NtCreateSection           = (void*) 0x0008D59B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABDAB,
        .NtQueryInformationFile    = (void*) 0x0009B58A,
        .NtQueryKey                = (void*) 0x00097CF1,
        .NtQueryValueKey           = (void*) 0x0009423B,
        .NtSetInformationFile      = (void*) 0x000A0FAC,
        .NtSetValueKey             = (void*) 0x0009DD9D,
        .ObpFreeObject             = (void*) 0x0008C921,
        .PspTerminateProcess       = (void*) 0x001556D2,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2765 (xpsp.050928-1517)"),
      TEXT("040335E8D8E841DD9729CF44B21C11792"),
      {
        .NtCreateProcess           = (void*) 0x000DD0A8,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D07E,
        .swprintf                  = (void*) 0x0002655A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2774 (xpsp.051011-1528)"),
      TEXT("9BEFAFFECB0B4E7684D537E7896F1D091"),
      {
        .NtCreateProcess           = (void*) 0x000F8A5C,
        .NtCreateProcessEx         = (void*) 0x000F89A6,
        .NtCreateSection           = (void*) 0x000D2DF2,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA1AE,
        .NtQueryInformationFile    = (void*) 0x000A27FE,
        .NtQueryKey                = (void*) 0x0014C75E,
        .NtQueryValueKey           = (void*) 0x0014915E,
        .NtSetInformationFile      = (void*) 0x000A2DCA,
        .NtSetValueKey             = (void*) 0x00149764,
        .ObpFreeObject             = (void*) 0x000E8752,
        .PspTerminateProcess       = (void*) 0x000FA328,
        .swprintf                  = (void*) 0x00063735,
        .ZwOpenProcess             = (void*) 0x00028B0C,
        .ZwProtectVirtualMemory    = (void*) 0x00028C38,
        .ZwReadVirtualMemory       = (void*) 0x0002900C,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2774 (xpsp.051011-1528)"),
      TEXT("4A60D40C68D74A7A91F60EB5C4B91D1B1"),
      {
        .NtCreateProcess           = (void*) 0x000EEE06,
        .NtCreateProcessEx         = (void*) 0x000EED50,
        .NtCreateSection           = (void*) 0x000C832E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F05E6,
        .NtQueryInformationFile    = (void*) 0x00097C1C,
        .NtQueryKey                = (void*) 0x001433EA,
        .NtQueryValueKey           = (void*) 0x0013FDEA,
        .NtSetInformationFile      = (void*) 0x00098220,
        .NtSetValueKey             = (void*) 0x001403F0,
        .ObpFreeObject             = (void*) 0x000DE302,
        .PspTerminateProcess       = (void*) 0x000F0760,
        .swprintf                  = (void*) 0x0005FC75,
        .ZwOpenProcess             = (void*) 0x00026D28,
        .ZwProtectVirtualMemory    = (void*) 0x00026E54,
        .ZwReadVirtualMemory       = (void*) 0x00027228,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2774 (xpsp.051011-1528)"),
      TEXT("53D901D8DB1340B4B49A8F1155E449E22"),
      {
        .NtCreateProcess           = (void*) 0x000D642C,
        .NtCreateProcessEx         = (void*) 0x000A951A,
        .NtCreateSection           = (void*) 0x0008D51B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABD2B,
        .NtQueryInformationFile    = (void*) 0x0009B50A,
        .NtQueryKey                = (void*) 0x00097C71,
        .NtQueryValueKey           = (void*) 0x000941BB,
        .NtSetInformationFile      = (void*) 0x000A0F2C,
        .NtSetValueKey             = (void*) 0x0009DD1D,
        .ObpFreeObject             = (void*) 0x0008C8A1,
        .PspTerminateProcess       = (void*) 0x00155646,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2774 (xpsp.051011-1528)"),
      TEXT("C5C5A2CF44924714BD7B4B42F2B227422"),
      {
        .NtCreateProcess           = (void*) 0x000DD0A8,
        .NtCreateProcessEx         = (void*) 0x000B3CC0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5549,
        .NtQueryInformationFile    = (void*) 0x000A7CAB,
        .NtQueryKey                = (void*) 0x000A0FFA,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AB9EE,
        .NtSetValueKey             = (void*) 0x000A8F03,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D094,
        .swprintf                  = (void*) 0x0002385A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2780 (xpsp.051019-1519)"),
      TEXT("36305F504228465EB4BCD5C83EF15B171"),
      {
        .NtCreateProcess           = (void*) 0x000EEE06,
        .NtCreateProcessEx         = (void*) 0x000EED50,
        .NtCreateSection           = (void*) 0x000C832E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F05E6,
        .NtQueryInformationFile    = (void*) 0x00097C1C,
        .NtQueryKey                = (void*) 0x001433EA,
        .NtQueryValueKey           = (void*) 0x0013FDEA,
        .NtSetInformationFile      = (void*) 0x00098220,
        .NtSetValueKey             = (void*) 0x001403F0,
        .ObpFreeObject             = (void*) 0x000DE302,
        .PspTerminateProcess       = (void*) 0x000F0760,
        .swprintf                  = (void*) 0x0005FC75,
        .ZwOpenProcess             = (void*) 0x00026D28,
        .ZwProtectVirtualMemory    = (void*) 0x00026E54,
        .ZwReadVirtualMemory       = (void*) 0x00027228,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2780 (xpsp.051019-1519)"),
      TEXT("1B090CFFA6AE431E9B1C7A5933A65D742"),
      {
        .NtCreateProcess           = (void*) 0x000D642C,
        .NtCreateProcessEx         = (void*) 0x000A951A,
        .NtCreateSection           = (void*) 0x0008D51B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000ABD2B,
        .NtQueryInformationFile    = (void*) 0x0009B50A,
        .NtQueryKey                = (void*) 0x00097C71,
        .NtQueryValueKey           = (void*) 0x000941BB,
        .NtSetInformationFile      = (void*) 0x000A0F2C,
        .NtSetValueKey             = (void*) 0x0009DD1D,
        .ObpFreeObject             = (void*) 0x0008C8A1,
        .PspTerminateProcess       = (void*) 0x00155646,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2845 (xpsp.060210-1526)"),
      TEXT("1AFF284D7C434F43979B2AE28D1E4EE21"),
      {
        .NtCreateProcess           = (void*) 0x000F8B10,
        .NtCreateProcessEx         = (void*) 0x000F8A5A,
        .NtCreateSection           = (void*) 0x000D2EA6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA262,
        .NtQueryInformationFile    = (void*) 0x000A2888,
        .NtQueryKey                = (void*) 0x0014C812,
        .NtQueryValueKey           = (void*) 0x00149212,
        .NtSetInformationFile      = (void*) 0x000A2E54,
        .NtSetValueKey             = (void*) 0x00149818,
        .ObpFreeObject             = (void*) 0x000E8806,
        .PspTerminateProcess       = (void*) 0x000FA3DC,
        .swprintf                  = (void*) 0x000638D5,
        .ZwOpenProcess             = (void*) 0x00028CA8,
        .ZwProtectVirtualMemory    = (void*) 0x00028DD4,
        .ZwReadVirtualMemory       = (void*) 0x000291A8,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2845 (xpsp.060210-1526)"),
      TEXT("A6C25E430DA54B1AA0C2DBA0F3C8FC3E1"),
      {
        .NtCreateProcess           = (void*) 0x000EF04A,
        .NtCreateProcessEx         = (void*) 0x000EEF94,
        .NtCreateSection           = (void*) 0x000C8572,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0828,
        .NtQueryInformationFile    = (void*) 0x00097E30,
        .NtQueryKey                = (void*) 0x00143616,
        .NtQueryValueKey           = (void*) 0x00140016,
        .NtSetInformationFile      = (void*) 0x00098434,
        .NtSetValueKey             = (void*) 0x0014061C,
        .ObpFreeObject             = (void*) 0x000DE546,
        .PspTerminateProcess       = (void*) 0x000F09A2,
        .swprintf                  = (void*) 0x0005FE35,
        .ZwOpenProcess             = (void*) 0x00026F08,
        .ZwProtectVirtualMemory    = (void*) 0x00027034,
        .ZwReadVirtualMemory       = (void*) 0x00027408,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2845 (xpsp.060210-1526)"),
      TEXT("71B34FCB62504F4EAEEEFF268CC10DD72"),
      {
        .NtCreateProcess           = (void*) 0x000D9BB5,
        .NtCreateProcessEx         = (void*) 0x000AAF82,
        .NtCreateSection           = (void*) 0x0008D71B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD840,
        .NtQueryInformationFile    = (void*) 0x0009A57E,
        .NtQueryKey                = (void*) 0x00097CB9,
        .NtQueryValueKey           = (void*) 0x00094203,
        .NtSetInformationFile      = (void*) 0x0009FF9C,
        .NtSetValueKey             = (void*) 0x0009CD8D,
        .ObpFreeObject             = (void*) 0x0008CAA1,
        .PspTerminateProcess       = (void*) 0x001558FA,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2845 (xpsp.060210-1526)"),
      TEXT("4289FD8BCB254A3CA5A2FF206D2E535D2"),
      {
        .NtCreateProcess           = (void*) 0x000E9C08,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D13A,
        .swprintf                  = (void*) 0x0002655A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2853 (xpsp_sp2_gdr.060220-1746)"),
      TEXT("AD416A59B488487E9F2D08FCC806B0581"),
      {
        .NtCreateProcess           = (void*) 0x000F8AD4,
        .NtCreateProcessEx         = (void*) 0x000F8A1E,
        .NtCreateSection           = (void*) 0x000D2E9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA226,
        .NtQueryInformationFile    = (void*) 0x000A286C,
        .NtQueryKey                = (void*) 0x0014C7C0,
        .NtQueryValueKey           = (void*) 0x001491C0,
        .NtSetInformationFile      = (void*) 0x000A2E38,
        .NtSetValueKey             = (void*) 0x001497C6,
        .ObpFreeObject             = (void*) 0x000E87FE,
        .PspTerminateProcess       = (void*) 0x000FA3A0,
        .swprintf                  = (void*) 0x000637F5,
        .ZwOpenProcess             = (void*) 0x00028BCC,
        .ZwProtectVirtualMemory    = (void*) 0x00028CF8,
        .ZwReadVirtualMemory       = (void*) 0x000290CC,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2853 (xpsp_sp2_gdr.060220-1746)"),
      TEXT("1EBA29264BF540EEA058A9992268B8801"),
      {
        .NtCreateProcess           = (void*) 0x000EEF8E,
        .NtCreateProcessEx         = (void*) 0x000EEED8,
        .NtCreateSection           = (void*) 0x000C84EA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F076C,
        .NtQueryInformationFile    = (void*) 0x00097D94,
        .NtQueryKey                = (void*) 0x00143544,
        .NtQueryValueKey           = (void*) 0x0013FF44,
        .NtSetInformationFile      = (void*) 0x00098398,
        .NtSetValueKey             = (void*) 0x0014054A,
        .ObpFreeObject             = (void*) 0x000DE4BE,
        .PspTerminateProcess       = (void*) 0x000F08E6,
        .swprintf                  = (void*) 0x0005FD65,
        .ZwOpenProcess             = (void*) 0x00026D98,
        .ZwProtectVirtualMemory    = (void*) 0x00026EC4,
        .ZwReadVirtualMemory       = (void*) 0x00027298,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2853 (xpsp_sp2_gdr.060220-1746)"),
      TEXT("6939A22A49B34CCC93C88B9F23924AB72"),
      {
        .NtCreateProcess           = (void*) 0x000D9AA4,
        .NtCreateProcessEx         = (void*) 0x000AAE82,
        .NtCreateSection           = (void*) 0x0008D61B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD740,
        .NtQueryInformationFile    = (void*) 0x0009A47E,
        .NtQueryKey                = (void*) 0x00097BB9,
        .NtQueryValueKey           = (void*) 0x00094103,
        .NtSetInformationFile      = (void*) 0x0009FE9C,
        .NtSetValueKey             = (void*) 0x0009CC8D,
        .ObpFreeObject             = (void*) 0x0008C9A1,
        .PspTerminateProcess       = (void*) 0x00155772,
        .swprintf                  = (void*) 0x0001C047,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2853 (xpsp_sp2_gdr.060220-1746)"),
      TEXT("9B934D5224B84CB396AF163480C147822"),
      {
        .NtCreateProcess           = (void*) 0x000E9BF0,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D0BA,
        .swprintf                  = (void*) 0x0002387A,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2853 (xpsp.060220-1751)"),
      TEXT("85545D4AB9AE40CF9807022CA7D94F391"),
      {
        .NtCreateProcess           = (void*) 0x000EF04A,
        .NtCreateProcessEx         = (void*) 0x000EEF94,
        .NtCreateSection           = (void*) 0x000C8572,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0828,
        .NtQueryInformationFile    = (void*) 0x00097E30,
        .NtQueryKey                = (void*) 0x00143616,
        .NtQueryValueKey           = (void*) 0x00140016,
        .NtSetInformationFile      = (void*) 0x00098434,
        .NtSetValueKey             = (void*) 0x0014061C,
        .ObpFreeObject             = (void*) 0x000DE546,
        .PspTerminateProcess       = (void*) 0x000F09A2,
        .swprintf                  = (void*) 0x0005FE35,
        .ZwOpenProcess             = (void*) 0x00026F08,
        .ZwProtectVirtualMemory    = (void*) 0x00027034,
        .ZwReadVirtualMemory       = (void*) 0x00027408,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2853 (xpsp.060220-1751)"),
      TEXT("97206FCD45F4469C8C8F9447DE8ECDE12"),
      {
        .NtCreateProcess           = (void*) 0x000D9BB5,
        .NtCreateProcessEx         = (void*) 0x000AAF82,
        .NtCreateSection           = (void*) 0x0008D71B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD840,
        .NtQueryInformationFile    = (void*) 0x0009A57E,
        .NtQueryKey                = (void*) 0x00097CB9,
        .NtQueryValueKey           = (void*) 0x00094203,
        .NtSetInformationFile      = (void*) 0x0009FF9C,
        .NtSetValueKey             = (void*) 0x0009CD8D,
        .ObpFreeObject             = (void*) 0x0008CAA1,
        .PspTerminateProcess       = (void*) 0x001558FA,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2868 (xpsp.060315-1524)"),
      TEXT("F2331C35CF85412890196BB85BD388E01"),
      {
        .NtCreateProcess           = (void*) 0x000F8B12,
        .NtCreateProcessEx         = (void*) 0x000F8A5C,
        .NtCreateSection           = (void*) 0x000D2EA8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA264,
        .NtQueryInformationFile    = (void*) 0x000A288A,
        .NtQueryKey                = (void*) 0x0014C814,
        .NtQueryValueKey           = (void*) 0x00149214,
        .NtSetInformationFile      = (void*) 0x000A2E56,
        .NtSetValueKey             = (void*) 0x0014981A,
        .ObpFreeObject             = (void*) 0x000E8808,
        .PspTerminateProcess       = (void*) 0x000FA3DE,
        .swprintf                  = (void*) 0x000638D5,
        .ZwOpenProcess             = (void*) 0x00028C90,
        .ZwProtectVirtualMemory    = (void*) 0x00028DBC,
        .ZwReadVirtualMemory       = (void*) 0x00029190,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2868 (xpsp.060315-1524)"),
      TEXT("23C083B907B0431CA019DA7F5E42A2671"),
      {
        .NtCreateProcess           = (void*) 0x000EF03E,
        .NtCreateProcessEx         = (void*) 0x000EEF88,
        .NtCreateSection           = (void*) 0x000C8566,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F081C,
        .NtQueryInformationFile    = (void*) 0x00097E2A,
        .NtQueryKey                = (void*) 0x00143612,
        .NtQueryValueKey           = (void*) 0x00140012,
        .NtSetInformationFile      = (void*) 0x0009842E,
        .NtSetValueKey             = (void*) 0x00140618,
        .ObpFreeObject             = (void*) 0x000DE53A,
        .PspTerminateProcess       = (void*) 0x000F0996,
        .swprintf                  = (void*) 0x0005FE35,
        .ZwOpenProcess             = (void*) 0x00026EEC,
        .ZwProtectVirtualMemory    = (void*) 0x00027018,
        .ZwReadVirtualMemory       = (void*) 0x000273EC,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2868 (xpsp.060315-1524)"),
      TEXT("795D57E8CCA7486387098DEFE009772C2"),
      {
        .NtCreateProcess           = (void*) 0x000D9BB5,
        .NtCreateProcessEx         = (void*) 0x000AAF82,
        .NtCreateSection           = (void*) 0x0008D71B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD840,
        .NtQueryInformationFile    = (void*) 0x0009A57E,
        .NtQueryKey                = (void*) 0x00097CB9,
        .NtQueryValueKey           = (void*) 0x00094203,
        .NtSetInformationFile      = (void*) 0x0009FF9C,
        .NtSetValueKey             = (void*) 0x0009CD8D,
        .ObpFreeObject             = (void*) 0x0008CAA1,
        .PspTerminateProcess       = (void*) 0x0015592E,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2868 (xpsp.060315-1524)"),
      TEXT("982C42F9C9094811B1F90AA8857945CE2"),
      {
        .NtCreateProcess           = (void*) 0x000E9C08,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D168,
        .swprintf                  = (void*) 0x0002655A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.2885 (xpsp.060411-1541)"),
      TEXT("DC1B268F6995464E8049D76F1C09A1911"),
      {
        .NtCreateProcess           = (void*) 0x000F8B1A,
        .NtCreateProcessEx         = (void*) 0x000F8A64,
        .NtCreateSection           = (void*) 0x000D2EA8,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA26C,
        .NtQueryInformationFile    = (void*) 0x000A288A,
        .NtQueryKey                = (void*) 0x0014C81C,
        .NtQueryValueKey           = (void*) 0x0014921C,
        .NtSetInformationFile      = (void*) 0x000A2E56,
        .NtSetValueKey             = (void*) 0x00149822,
        .ObpFreeObject             = (void*) 0x000E8808,
        .PspTerminateProcess       = (void*) 0x000FA3E6,
        .swprintf                  = (void*) 0x00063975,
        .ZwOpenProcess             = (void*) 0x00028CE8,
        .ZwProtectVirtualMemory    = (void*) 0x00028E14,
        .ZwReadVirtualMemory       = (void*) 0x000291E8,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.2885 (xpsp.060411-1541)"),
      TEXT("B6C8E62983CF4D248EB7B27852128EA71"),
      {
        .NtCreateProcess           = (void*) 0x000EF0C6,
        .NtCreateProcessEx         = (void*) 0x000EF010,
        .NtCreateSection           = (void*) 0x000C85E6,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F08A4,
        .NtQueryInformationFile    = (void*) 0x00097EAA,
        .NtQueryKey                = (void*) 0x0014369A,
        .NtQueryValueKey           = (void*) 0x0014009A,
        .NtSetInformationFile      = (void*) 0x000984AE,
        .NtSetValueKey             = (void*) 0x001406A0,
        .ObpFreeObject             = (void*) 0x000DE5BA,
        .PspTerminateProcess       = (void*) 0x000F0A1E,
        .swprintf                  = (void*) 0x0005FED5,
        .ZwOpenProcess             = (void*) 0x00026EE0,
        .ZwProtectVirtualMemory    = (void*) 0x0002700C,
        .ZwReadVirtualMemory       = (void*) 0x000273E0,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.2885 (xpsp.060411-1541)"),
      TEXT("3267232A6DEE4A1CB588270118C75F062"),
      {
        .NtCreateProcess           = (void*) 0x000D9C35,
        .NtCreateProcessEx         = (void*) 0x000AB002,
        .NtCreateSection           = (void*) 0x0008D79B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD8C0,
        .NtQueryInformationFile    = (void*) 0x0009A5FE,
        .NtQueryKey                = (void*) 0x00097D39,
        .NtQueryValueKey           = (void*) 0x00094283,
        .NtSetInformationFile      = (void*) 0x000A001C,
        .NtSetValueKey             = (void*) 0x0009CE0D,
        .ObpFreeObject             = (void*) 0x0008CB21,
        .PspTerminateProcess       = (void*) 0x001559B6,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.2885 (xpsp.060411-1541)"),
      TEXT("B54BA915B1E341E99E6C33B280BE83512"),
      {
        .NtCreateProcess           = (void*) 0x000E9C08,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D16C,
        .swprintf                  = (void*) 0x0002655A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.3014 (xpsp.061012-0254)"),
      TEXT("974AD9660ACF4598B8E26A0B6227108F1"),
      {
        .NtCreateProcess           = (void*) 0x000F8C4A,
        .NtCreateProcessEx         = (void*) 0x000F8B94,
        .NtCreateSection           = (void*) 0x000D2F9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA39E,
        .NtQueryInformationFile    = (void*) 0x000A289A,
        .NtQueryKey                = (void*) 0x0014C948,
        .NtQueryValueKey           = (void*) 0x00149348,
        .NtSetInformationFile      = (void*) 0x000A2E66,
        .NtSetValueKey             = (void*) 0x0014994E,
        .ObpFreeObject             = (void*) 0x000E88FE,
        .PspTerminateProcess       = (void*) 0x000FA518,
        .swprintf                  = (void*) 0x000639F5,
        .ZwOpenProcess             = (void*) 0x00028CF4,
        .ZwProtectVirtualMemory    = (void*) 0x00028E20,
        .ZwReadVirtualMemory       = (void*) 0x000291F4,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.3014 (xpsp.061012-0254)"),
      TEXT("14E65FC367CD4D2A83264A1CFEB2E7751"),
      {
        .NtCreateProcess           = (void*) 0x000EF26C,
        .NtCreateProcessEx         = (void*) 0x000EF1B6,
        .NtCreateSection           = (void*) 0x000C8744,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0A4A,
        .NtQueryInformationFile    = (void*) 0x00097F32,
        .NtQueryKey                = (void*) 0x00143826,
        .NtQueryValueKey           = (void*) 0x00140226,
        .NtSetInformationFile      = (void*) 0x00098536,
        .NtSetValueKey             = (void*) 0x0014082C,
        .ObpFreeObject             = (void*) 0x000DE718,
        .PspTerminateProcess       = (void*) 0x000F0BC4,
        .swprintf                  = (void*) 0x0005FF45,
        .ZwOpenProcess             = (void*) 0x00026F08,
        .ZwProtectVirtualMemory    = (void*) 0x00027034,
        .ZwReadVirtualMemory       = (void*) 0x00027408,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.3014 (xpsp.061012-0254)"),
      TEXT("F8DE4616591E4A8683129E2A1464499C2"),
      {
        .NtCreateProcess           = (void*) 0x000D91A1,
        .NtCreateProcessEx         = (void*) 0x000AB01E,
        .NtCreateSection           = (void*) 0x0008D81B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD789,
        .NtQueryInformationFile    = (void*) 0x0009F96B,
        .NtQueryKey                = (void*) 0x000990C7,
        .NtQueryValueKey           = (void*) 0x00095316,
        .NtSetInformationFile      = (void*) 0x0009EA88,
        .NtSetValueKey             = (void*) 0x000A23CA,
        .ObpFreeObject             = (void*) 0x0008CBA1,
        .PspTerminateProcess       = (void*) 0x00155C1A,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.3014 (xpsp.061012-0254)"),
      TEXT("E66FB71131C245278B98AE4B5472BFB52"),
      {
        .NtCreateProcess           = (void*) 0x000E9020,
        .NtCreateProcessEx         = (void*) 0x000B43BC,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B7281,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x000A0AD8,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AC3C8,
        .NtSetValueKey             = (void*) 0x000AA732,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D38A,
        .swprintf                  = (void*) 0x0002658A,
        .ZwOpenProcess             = (void*) 0x0000CBFA,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD26,
        .ZwReadVirtualMemory       = (void*) 0x0000D0FA,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.3023 (xpsp_sp2_qfe.061030-0020)"),
      TEXT("D06267DBA44B4577ACBEFB98D0A2A1501"),
      {
        .NtCreateProcess           = (void*) 0x000F8C4A,
        .NtCreateProcessEx         = (void*) 0x000F8B94,
        .NtCreateSection           = (void*) 0x000D2F9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA39E,
        .NtQueryInformationFile    = (void*) 0x000A289A,
        .NtQueryKey                = (void*) 0x0014C948,
        .NtQueryValueKey           = (void*) 0x00149348,
        .NtSetInformationFile      = (void*) 0x000A2E66,
        .NtSetValueKey             = (void*) 0x0014994E,
        .ObpFreeObject             = (void*) 0x000E88FE,
        .PspTerminateProcess       = (void*) 0x000FA518,
        .swprintf                  = (void*) 0x00063A05,
        .ZwOpenProcess             = (void*) 0x00028D04,
        .ZwProtectVirtualMemory    = (void*) 0x00028E30,
        .ZwReadVirtualMemory       = (void*) 0x00029204,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.3023 (xpsp_sp2_qfe.061030-0020)"),
      TEXT("41A9DC76628943EA8563E538BE8682221"),
      {
        .NtCreateProcess           = (void*) 0x000EF26C,
        .NtCreateProcessEx         = (void*) 0x000EF1B6,
        .NtCreateSection           = (void*) 0x000C8744,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0A4A,
        .NtQueryInformationFile    = (void*) 0x00097F32,
        .NtQueryKey                = (void*) 0x00143826,
        .NtQueryValueKey           = (void*) 0x00140226,
        .NtSetInformationFile      = (void*) 0x00098536,
        .NtSetValueKey             = (void*) 0x0014082C,
        .ObpFreeObject             = (void*) 0x000DE718,
        .PspTerminateProcess       = (void*) 0x000F0BC4,
        .swprintf                  = (void*) 0x0005FF55,
        .ZwOpenProcess             = (void*) 0x00026F18,
        .ZwProtectVirtualMemory    = (void*) 0x00027044,
        .ZwReadVirtualMemory       = (void*) 0x00027418,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.3023 (xpsp_sp2_qfe.061030-0020)"),
      TEXT("89017B70BAA9436FB806242D31DC30602"),
      {
        .NtCreateProcess           = (void*) 0x000D91A1,
        .NtCreateProcessEx         = (void*) 0x000AB01E,
        .NtCreateSection           = (void*) 0x0008D81B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD789,
        .NtQueryInformationFile    = (void*) 0x0009F96B,
        .NtQueryKey                = (void*) 0x000990C7,
        .NtQueryValueKey           = (void*) 0x00095316,
        .NtSetInformationFile      = (void*) 0x0009EA88,
        .NtSetValueKey             = (void*) 0x000A23CA,
        .ObpFreeObject             = (void*) 0x0008CBA1,
        .PspTerminateProcess       = (void*) 0x00155C1A,
        .swprintf                  = (void*) 0x000208EE,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.3023 (xpsp_sp2_qfe.061030-0020)"),
      TEXT("68199A72D5A64F29AB7AF5B3AD1E8ECB2"),
      {
        .NtCreateProcess           = (void*) 0x000E9020,
        .NtCreateProcessEx         = (void*) 0x000B43BC,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B7281,
        .NtQueryInformationFile    = (void*) 0x000A8B72,
        .NtQueryKey                = (void*) 0x000A0AD8,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000AC3C8,
        .NtSetValueKey             = (void*) 0x000AA732,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D38A,
        .swprintf                  = (void*) 0x0002659A,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.3023 (xpsp_sp2_gdr.061030-0016)"),
      TEXT("17687859CFC64F1AB086A2FDF2B9337D1"),
      {
        .NtCreateProcess           = (void*) 0x000F8AD4,
        .NtCreateProcessEx         = (void*) 0x000F8A1E,
        .NtCreateSection           = (void*) 0x000D2E9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA226,
        .NtQueryInformationFile    = (void*) 0x000A286C,
        .NtQueryKey                = (void*) 0x0014C7C0,
        .NtQueryValueKey           = (void*) 0x001491C0,
        .NtSetInformationFile      = (void*) 0x000A2E38,
        .NtSetValueKey             = (void*) 0x001497C6,
        .ObpFreeObject             = (void*) 0x000E87FE,
        .PspTerminateProcess       = (void*) 0x000FA3A0,
        .swprintf                  = (void*) 0x000638C5,
        .ZwOpenProcess             = (void*) 0x00028BDC,
        .ZwProtectVirtualMemory    = (void*) 0x00028D08,
        .ZwReadVirtualMemory       = (void*) 0x000290DC,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.3023 (xpsp_sp2_gdr.061030-0016)"),
      TEXT("457794883C7943C9B06ED499F6059B602"),
      {
        .NtCreateProcess           = (void*) 0x000E9BF0,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D0BA,
        .swprintf                  = (void*) 0x0002385A,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.3051 (xpsp_sp2_qfe.061219-0311)"),
      TEXT("F67236BB349E4666B96B5D6E57461D161"),
      {
        .NtCreateProcess           = (void*) 0x000F8C4A,
        .NtCreateProcessEx         = (void*) 0x000F8B94,
        .NtCreateSection           = (void*) 0x000D2F9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA39E,
        .NtQueryInformationFile    = (void*) 0x000A289A,
        .NtQueryKey                = (void*) 0x0014C948,
        .NtQueryValueKey           = (void*) 0x00149348,
        .NtSetInformationFile      = (void*) 0x000A2E66,
        .NtSetValueKey             = (void*) 0x0014994E,
        .ObpFreeObject             = (void*) 0x000E88FE,
        .PspTerminateProcess       = (void*) 0x000FA518,
        .swprintf                  = (void*) 0x000639D5,
        .ZwOpenProcess             = (void*) 0x00028D04,
        .ZwProtectVirtualMemory    = (void*) 0x00028E30,
        .ZwReadVirtualMemory       = (void*) 0x00029204,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.3051 (xpsp_sp2_qfe.061219-0311)"),
      TEXT("E4A93C3F8FC744B3816664693BB727111"),
      {
        .NtCreateProcess           = (void*) 0x000EF2EC,
        .NtCreateProcessEx         = (void*) 0x000EF236,
        .NtCreateSection           = (void*) 0x000C87C4,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F0ACA,
        .NtQueryInformationFile    = (void*) 0x00097FB2,
        .NtQueryKey                = (void*) 0x001438A6,
        .NtQueryValueKey           = (void*) 0x001402A6,
        .NtSetInformationFile      = (void*) 0x000985B6,
        .NtSetValueKey             = (void*) 0x001408AC,
        .ObpFreeObject             = (void*) 0x000DE798,
        .PspTerminateProcess       = (void*) 0x000F0C44,
        .swprintf                  = (void*) 0x0005FF65,
        .ZwOpenProcess             = (void*) 0x00026F18,
        .ZwProtectVirtualMemory    = (void*) 0x00027044,
        .ZwReadVirtualMemory       = (void*) 0x00027418,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.3051 (xpsp_sp2_qfe.061219-0311)"),
      TEXT("6E9A14FCD68D4E888B7A893EA7A2645A2"),
      {
        .NtCreateProcess           = (void*) 0x000D9199,
        .NtCreateProcessEx         = (void*) 0x000AB016,
        .NtCreateSection           = (void*) 0x0008D81B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD781,
        .NtQueryInformationFile    = (void*) 0x0009B95E,
        .NtQueryKey                = (void*) 0x00097DB9,
        .NtQueryValueKey           = (void*) 0x00094303,
        .NtSetInformationFile      = (void*) 0x000A22F1,
        .NtSetValueKey             = (void*) 0x0009E16D,
        .ObpFreeObject             = (void*) 0x0008CBA1,
        .PspTerminateProcess       = (void*) 0x00155C12,
        .swprintf                  = (void*) 0x00019970,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.3051 (xpsp_sp2_qfe.061219-0311)"),
      TEXT("53A4AEB8EF0A407FACC9D8DA4BE5284D2"),
      {
        .NtCreateProcess           = (void*) 0x000E9028,
        .NtCreateProcessEx         = (void*) 0x000B34E0,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B63A5,
        .NtQueryInformationFile    = (void*) 0x000A37EA,
        .NtQueryKey                = (void*) 0x000A0AD8,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000A4E81,
        .NtSetValueKey             = (void*) 0x000AAB1E,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D392,
        .swprintf                  = (void*) 0x00024ED9,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrpamp 5.1.2600.3051 (xpsp_sp2_gdr.061219-0316)"),
      TEXT("E59C275A6E4D4461BBFE8C54DC187B341"),
      {
        .NtCreateProcess           = (void*) 0x000F8AD4,
        .NtCreateProcessEx         = (void*) 0x000F8A1E,
        .NtCreateSection           = (void*) 0x000D2E9E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000FA226,
        .NtQueryInformationFile    = (void*) 0x000A286C,
        .NtQueryKey                = (void*) 0x0014C7C0,
        .NtQueryValueKey           = (void*) 0x001491C0,
        .NtSetInformationFile      = (void*) 0x000A2E38,
        .NtSetValueKey             = (void*) 0x001497C6,
        .ObpFreeObject             = (void*) 0x000E87FE,
        .PspTerminateProcess       = (void*) 0x000FA3A0,
        .swprintf                  = (void*) 0x00063895,
        .ZwOpenProcess             = (void*) 0x00028BDC,
        .ZwProtectVirtualMemory    = (void*) 0x00028D08,
        .ZwReadVirtualMemory       = (void*) 0x000290DC,
      }
    },
    {
      TEXT("ntkrnlpa 5.1.2600.3051 (xpsp_sp2_gdr.061219-0316)"),
      TEXT("A85A022656B24A8587F90BF0C2ED15011"),
      {
        .NtCreateProcess           = (void*) 0x000EEF8E,
        .NtCreateProcessEx         = (void*) 0x000EEED8,
        .NtCreateSection           = (void*) 0x000C84EA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F076C,
        .NtQueryInformationFile    = (void*) 0x00097D94,
        .NtQueryKey                = (void*) 0x00143544,
        .NtQueryValueKey           = (void*) 0x0013FF44,
        .NtSetInformationFile      = (void*) 0x00098398,
        .NtSetValueKey             = (void*) 0x0014054A,
        .ObpFreeObject             = (void*) 0x000DE4BE,
        .PspTerminateProcess       = (void*) 0x000F08E6,
        .swprintf                  = (void*) 0x0005FDC5,
        .ZwOpenProcess             = (void*) 0x00026DC8,
        .ZwProtectVirtualMemory    = (void*) 0x00026EF4,
        .ZwReadVirtualMemory       = (void*) 0x000272C8,
      }
    },
    {
      TEXT("ntoskrnl 5.1.2600.3051 (xpsp_sp2_gdr.061219-0316)"),
      TEXT("3F158FA7B78E451C9756DF117E5E8A1E2"),
      {
        .NtCreateProcess           = (void*) 0x000D9AA4,
        .NtCreateProcessEx         = (void*) 0x000AAE82,
        .NtCreateSection           = (void*) 0x0008D61B,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000AD740,
        .NtQueryInformationFile    = (void*) 0x0009A47E,
        .NtQueryKey                = (void*) 0x00097BB9,
        .NtQueryValueKey           = (void*) 0x00094103,
        .NtSetInformationFile      = (void*) 0x0009FE9C,
        .NtSetValueKey             = (void*) 0x0009CC8D,
        .ObpFreeObject             = (void*) 0x0008C9A1,
        .PspTerminateProcess       = (void*) 0x00155772,
        .swprintf                  = (void*) 0x0001BA14,
        .ZwOpenProcess             = (void*) 0x00006044,
        .ZwProtectVirtualMemory    = (void*) 0x00006170,
        .ZwReadVirtualMemory       = (void*) 0x00006544,
      }
    },
    {
      TEXT("ntkrnlmp 5.1.2600.3051 (xpsp_sp2_gdr.061219-0316)"),
      TEXT("33AD26D796B84CB896736344DA9D043D2"),
      {
        .NtCreateProcess           = (void*) 0x000E9BF0,
        .NtCreateProcessEx         = (void*) 0x000B3B10,
        .NtCreateSection           = (void*) 0x00095E25,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B5399,
        .NtQueryInformationFile    = (void*) 0x000A7CBB,
        .NtQueryKey                = (void*) 0x000A0FAC,
        .NtQueryValueKey           = (void*) 0x0009B100,
        .NtSetInformationFile      = (void*) 0x000ABBC5,
        .NtSetValueKey             = (void*) 0x000A8F13,
        .ObpFreeObject             = (void*) 0x00095640,
        .PspTerminateProcess       = (void*) 0x0015D0BA,
        .swprintf                  = (void*) 0x000259C1,
        .ZwOpenProcess             = (void*) 0x0000CC0A,
        .ZwProtectVirtualMemory    = (void*) 0x0000CD36,
        .ZwReadVirtualMemory       = (void*) 0x0000D10A,
      }
    },
    {
      TEXT("ntkrpamp 5.2.3790.0 (srv03_rtm.030324-2048)"),
      TEXT("0FE0EA646FD64F91B512E45B9FCB61C81"),
      {
        .NtCreateProcess           = (void*) 0x00124E5E,
        .NtCreateProcessEx         = (void*) 0x00124DB6,
        .NtCreateSection           = (void*) 0x000FC64E,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x001264F6,
        .NtQueryInformationFile    = (void*) 0x000C7262,
        .NtQueryKey                = (void*) 0x0009AD70,
        .NtQueryValueKey           = (void*) 0x0009AFF0,
        .NtSetInformationFile      = (void*) 0x000C7812,
        .NtSetValueKey             = (void*) 0x00097DD6,
        .ObpFreeObject             = (void*) 0x00114762,
        .PspTerminateProcess       = (void*) 0x0012668A,
        .swprintf                  = (void*) 0x00066E46,
        .ZwOpenProcess             = (void*) 0x00029780,
        .ZwProtectVirtualMemory    = (void*) 0x000298AC,
        .ZwReadVirtualMemory       = (void*) 0x00029CA8,
      }
    },
    {
      TEXT("ntkrnlpa 5.2.3790.0 (srv03_rtm.030324-2048)"),
      TEXT("3E5EC2822A12407CAE564E6D6D0619B31"),
      {
        .NtCreateProcess           = (void*) 0x0011CFC8,
        .NtCreateProcessEx         = (void*) 0x0011CF20,
        .NtCreateSection           = (void*) 0x000F4CDC,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0011E640,
        .NtQueryInformationFile    = (void*) 0x000C0004,
        .NtQueryKey                = (void*) 0x00093D5E,
        .NtQueryValueKey           = (void*) 0x00093FDE,
        .NtSetInformationFile      = (void*) 0x000C05B2,
        .NtSetValueKey             = (void*) 0x00090DC4,
        .ObpFreeObject             = (void*) 0x0010CA98,
        .PspTerminateProcess       = (void*) 0x0011E7D4,
        .swprintf                  = (void*) 0x00061F06,
        .ZwOpenProcess             = (void*) 0x00027BD0,
        .ZwProtectVirtualMemory    = (void*) 0x00027CFC,
        .ZwReadVirtualMemory       = (void*) 0x000280F8,
      }
    },
    {
      TEXT("ntoskrnl 5.2.3790.0 (srv03_rtm.030324-2048)"),
      TEXT("112679F166D6449394EFC30950DE9E032"),
      {
        .NtCreateProcess           = (void*) 0x000DF684,
        .NtCreateProcessEx         = (void*) 0x000B0FE3,
        .NtCreateSection           = (void*) 0x00095ECA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B2CBA,
        .NtQueryInformationFile    = (void*) 0x000A72CF,
        .NtQueryKey                = (void*) 0x000A2C31,
        .NtQueryValueKey           = (void*) 0x00099D61,
        .NtSetInformationFile      = (void*) 0x0009A747,
        .NtSetValueKey             = (void*) 0x000B4859,
        .ObpFreeObject             = (void*) 0x00095231,
        .PspTerminateProcess       = (void*) 0x000D3B76,
        .swprintf                  = (void*) 0x0002D6A9,
        .ZwOpenProcess             = (void*) 0x000081D2,
        .ZwProtectVirtualMemory    = (void*) 0x00008330,
        .ZwReadVirtualMemory       = (void*) 0x000087B8,
      }
    },
    {
      TEXT("ntkrnlmp 5.2.3790.0 (srv03_rtm.030324-2048)"),
      TEXT("4E4A894DD1A64BC3ADFEA71F18E293642"),
      {
        .NtCreateProcess           = (void*) 0x000E0800,
        .NtCreateProcessEx         = (void*) 0x000F28A0,
        .NtCreateSection           = (void*) 0x000C2AA0,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F12D0,
        .NtQueryInformationFile    = (void*) 0x000C1DE0,
        .NtQueryKey                = (void*) 0x000CE150,
        .NtQueryValueKey           = (void*) 0x000B2350,
        .NtSetInformationFile      = (void*) 0x000B4410,
        .NtSetValueKey             = (void*) 0x000BB6B0,
        .ObpFreeObject             = (void*) 0x000A87D0,
        .PspTerminateProcess       = (void*) 0x00180AE0,
        .swprintf                  = (void*) 0x00021ED0,
        .ZwOpenProcess             = (void*) 0x0000D5B0,
        .ZwProtectVirtualMemory    = (void*) 0x0000D7E0,
        .ZwReadVirtualMemory       = (void*) 0x0000DEAC,
      }
    },
    {
      TEXT("ntkrpamp 5.2.3790.280 (srv03_gdr.050225-1827)"),
      TEXT("E6557729FE244544B9F0FE18878C7E671"),
      {
        .NtCreateProcess           = (void*) 0x00124E88,
        .NtCreateProcessEx         = (void*) 0x00124DE0,
        .NtCreateSection           = (void*) 0x000FC660,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0012652E,
        .NtQueryInformationFile    = (void*) 0x000C7256,
        .NtQueryKey                = (void*) 0x0009AD70,
        .NtQueryValueKey           = (void*) 0x0009AFF0,
        .NtSetInformationFile      = (void*) 0x000C7806,
        .NtSetValueKey             = (void*) 0x00097DD6,
        .ObpFreeObject             = (void*) 0x00114774,
        .PspTerminateProcess       = (void*) 0x001266C2,
        .swprintf                  = (void*) 0x00066ED6,
        .ZwOpenProcess             = (void*) 0x00029780,
        .ZwProtectVirtualMemory    = (void*) 0x000298AC,
        .ZwReadVirtualMemory       = (void*) 0x00029CA8,
      }
    },
    {
      TEXT("ntkrnlpa 5.2.3790.280 (srv03_gdr.050225-1827)"),
      TEXT("69D0093E45FE41F5BA41F693D249E0511"),
      {
        .NtCreateProcess           = (void*) 0x0011CFFA,
        .NtCreateProcessEx         = (void*) 0x0011CF52,
        .NtCreateSection           = (void*) 0x000F4D02,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0011E672,
        .NtQueryInformationFile    = (void*) 0x000BFFF8,
        .NtQueryKey                = (void*) 0x00093D5E,
        .NtQueryValueKey           = (void*) 0x00093FDE,
        .NtSetInformationFile      = (void*) 0x000C05A6,
        .NtSetValueKey             = (void*) 0x00090DC4,
        .ObpFreeObject             = (void*) 0x0010CABE,
        .PspTerminateProcess       = (void*) 0x0011E806,
        .swprintf                  = (void*) 0x00061F96,
        .ZwOpenProcess             = (void*) 0x00027BD0,
        .ZwProtectVirtualMemory    = (void*) 0x00027CFC,
        .ZwReadVirtualMemory       = (void*) 0x000280F8,
      }
    },
    {
      TEXT("ntoskrnl 5.2.3790.280 (srv03_gdr.050225-1827)"),
      TEXT("39C0C738C4EA49F7A0FBC098FCF6153C2"),
      {
        .NtCreateProcess           = (void*) 0x000E5320,
        .NtCreateProcessEx         = (void*) 0x000AFE8E,
        .NtCreateSection           = (void*) 0x00095ECA,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000B33BF,
        .NtQueryInformationFile    = (void*) 0x000A74D2,
        .NtQueryKey                = (void*) 0x000A2E23,
        .NtQueryValueKey           = (void*) 0x00099D68,
        .NtSetInformationFile      = (void*) 0x0009A68B,
        .NtSetValueKey             = (void*) 0x000B500D,
        .ObpFreeObject             = (void*) 0x00095231,
        .PspTerminateProcess       = (void*) 0x000DAB8B,
        .swprintf                  = (void*) 0x0002AA71,
        .ZwOpenProcess             = (void*) 0x000081D2,
        .ZwProtectVirtualMemory    = (void*) 0x00008330,
        .ZwReadVirtualMemory       = (void*) 0x000087B8,
      }
    },
    {
      TEXT("ntkrnlmp 5.2.3790.280 (srv03_gdr.050225-1827)"),
      TEXT("54E9775FEC794E8C8B8EEDD84A06E7A02"),
      {
        .NtCreateProcess           = (void*) 0x000DE4E0,
        .NtCreateProcessEx         = (void*) 0x000F64D0,
        .NtCreateSection           = (void*) 0x000BFE60,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F49D0,
        .NtQueryInformationFile    = (void*) 0x000BF2C0,
        .NtQueryKey                = (void*) 0x000D0960,
        .NtQueryValueKey           = (void*) 0x000B2D50,
        .NtSetInformationFile      = (void*) 0x000B25B0,
        .NtSetValueKey             = (void*) 0x000BC580,
        .ObpFreeObject             = (void*) 0x000A8840,
        .PspTerminateProcess       = (void*) 0x001810A0,
        .swprintf                  = (void*) 0x00026B60,
        .ZwOpenProcess             = (void*) 0x0000D5B0,
        .ZwProtectVirtualMemory    = (void*) 0x0000D7E0,
        .ZwReadVirtualMemory       = (void*) 0x0000DEAC,
      }
    },
    {
      TEXT("ntkrpamp 5.2.3790.280 (srv03_qfe.050225-1637)"),
      TEXT("35583D27512F43C3BB85C59E392D31411"),
      {
        .NtCreateProcess           = (void*) 0x00126036,
        .NtCreateProcessEx         = (void*) 0x00125F8E,
        .NtCreateSection           = (void*) 0x000FD7AE,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x001276F2,
        .NtQueryInformationFile    = (void*) 0x000C8324,
        .NtQueryKey                = (void*) 0x0009BD70,
        .NtQueryValueKey           = (void*) 0x0009BFF0,
        .NtSetInformationFile      = (void*) 0x000C88D4,
        .NtSetValueKey             = (void*) 0x00098DD6,
        .ObpFreeObject             = (void*) 0x0011592E,
        .PspTerminateProcess       = (void*) 0x00127886,
        .swprintf                  = (void*) 0x000674B6,
        .ZwOpenProcess             = (void*) 0x00029A0C,
        .ZwProtectVirtualMemory    = (void*) 0x00029B38,
        .ZwReadVirtualMemory       = (void*) 0x00029F34,
      }
    },
    {
      TEXT("ntkrnlmp 5.2.3790.280 (srv03_qfe.050225-1637)"),
      TEXT("E0408A59CF1D4ABEA81C2A09C5DC9A022"),
      {
        .NtCreateProcess           = (void*) 0x000DF500,
        .NtCreateProcessEx         = (void*) 0x000F7550,
        .NtCreateSection           = (void*) 0x000C0E60,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x000F5A30,
        .NtQueryInformationFile    = (void*) 0x000C02C0,
        .NtQueryKey                = (void*) 0x000D1980,
        .NtQueryValueKey           = (void*) 0x000B3D50,
        .NtSetInformationFile      = (void*) 0x000B35B0,
        .NtSetValueKey             = (void*) 0x000BD580,
        .ObpFreeObject             = (void*) 0x000A9840,
        .PspTerminateProcess       = (void*) 0x00182320,
        .swprintf                  = (void*) 0x00029350,
        .ZwOpenProcess             = (void*) 0x0000D630,
        .ZwProtectVirtualMemory    = (void*) 0x0000D860,
        .ZwReadVirtualMemory       = (void*) 0x0000DF2C,
      }
    },
    {
      TEXT("ntkrpamp 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)"),
      TEXT("FEC480982D1145E696432CBBD9BC2C831"),
      {
        .NtCreateProcess           = (void*) 0x00149F68,
        .NtCreateProcessEx         = (void*) 0x00149EB2,
        .NtCreateSection           = (void*) 0x00126D80,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0014B762,
        .NtQueryInformationFile    = (void*) 0x000EF886,
        .NtQueryKey                = (void*) 0x000BB122,
        .NtQueryValueKey           = (void*) 0x000BB3B0,
        .NtSetInformationFile      = (void*) 0x000EFE88,
        .NtSetValueKey             = (void*) 0x000BB97E,
        .ObpFreeObject             = (void*) 0x001386AC,
        .PspTerminateProcess       = (void*) 0x0014B8FE,
        .swprintf                  = (void*) 0x000828EB,
        .ZwOpenProcess             = (void*) 0x0002E7E8,
        .ZwProtectVirtualMemory    = (void*) 0x0002E914,
        .ZwReadVirtualMemory       = (void*) 0x0002ED10,
      }
    },
    {
      TEXT("ntkrnlpa 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)"),
      TEXT("80A87123E83C40579E8319E5DB7B523C1"),
      {
        .NtCreateProcess           = (void*) 0x00141D12,
        .NtCreateProcessEx         = (void*) 0x00141C5C,
        .NtCreateSection           = (void*) 0x0011EB70,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x001434F4,
        .NtQueryInformationFile    = (void*) 0x000E7860,
        .NtQueryKey                = (void*) 0x000B3110,
        .NtQueryValueKey           = (void*) 0x000B339E,
        .NtSetInformationFile      = (void*) 0x000E7E62,
        .NtSetValueKey             = (void*) 0x000B396C,
        .ObpFreeObject             = (void*) 0x001304A8,
        .PspTerminateProcess       = (void*) 0x00143690,
        .swprintf                  = (void*) 0x0007D2EB,
        .ZwOpenProcess             = (void*) 0x0002C940,
        .ZwProtectVirtualMemory    = (void*) 0x0002CA6C,
        .ZwReadVirtualMemory       = (void*) 0x0002CE68,
      }
    },
    {
      TEXT("ntoskrnl 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)"),
      TEXT("4106003FF97D4BCBA99245BF2172A8C12"),
      {
        .NtCreateProcess           = (void*) 0x000CA98C,
        .NtCreateProcessEx         = (void*) 0x0011DFDB,
        .NtCreateSection           = (void*) 0x001087E4,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x00112F97,
        .NtQueryInformationFile    = (void*) 0x00107F94,
        .NtQueryKey                = (void*) 0x0012E22D,
        .NtQueryValueKey           = (void*) 0x0012C2BB,
        .NtSetInformationFile      = (void*) 0x0010F92B,
        .NtSetValueKey             = (void*) 0x0012C6EB,
        .ObpFreeObject             = (void*) 0x001024BD,
        .PspTerminateProcess       = (void*) 0x0019701A,
        .swprintf                  = (void*) 0x00018CB7,
        .ZwOpenProcess             = (void*) 0x00021B54,
        .ZwProtectVirtualMemory    = (void*) 0x00021C80,
        .ZwReadVirtualMemory       = (void*) 0x0002207C,
      }
    },
    {
      TEXT("ntkrnlmp 5.2.3790.1830 (srv03_sp1_rtm.050324-1447)"),
      TEXT("D11928D0A382448AA96E545C81E4DD172"),
      {
        .NtCreateProcess           = (void*) 0x000F80EA,
        .NtCreateProcessEx         = (void*) 0x001133C4,
        .NtCreateSection           = (void*) 0x0013234C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0011288D,
        .NtQueryInformationFile    = (void*) 0x0012F5F0,
        .NtQueryKey                = (void*) 0x0013F321,
        .NtQueryValueKey           = (void*) 0x0013CB76,
        .NtSetInformationFile      = (void*) 0x0012F8F4,
        .NtSetValueKey             = (void*) 0x0013294F,
        .ObpFreeObject             = (void*) 0x0012AAD5,
        .PspTerminateProcess       = (void*) 0x001A237A,
        .swprintf                  = (void*) 0x0001C605,
        .ZwOpenProcess             = (void*) 0x0003C8D0,
        .ZwProtectVirtualMemory    = (void*) 0x0003C9FC,
        .ZwReadVirtualMemory       = (void*) 0x0003CDF8,
      }
    },
    {
      TEXT("ntkrpamp 5.2.3790.2438 (srv03_sp1_qfe.050504-1733)"),
      TEXT("8C08A30DAE7F49DD9D1F68B48D5DA1B61"),
      {
        .NtCreateProcess           = (void*) 0x0014A23E,
        .NtCreateProcessEx         = (void*) 0x0014A188,
        .NtCreateSection           = (void*) 0x00127048,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0014BA3A,
        .NtQueryInformationFile    = (void*) 0x000EFB2C,
        .NtQueryKey                = (void*) 0x000BB122,
        .NtQueryValueKey           = (void*) 0x000BB3B0,
        .NtSetInformationFile      = (void*) 0x000F012E,
        .NtSetValueKey             = (void*) 0x000BB97E,
        .ObpFreeObject             = (void*) 0x00138974,
        .PspTerminateProcess       = (void*) 0x0014BBD6,
        .swprintf                  = (void*) 0x00082A5B,
        .ZwOpenProcess             = (void*) 0x0002E93C,
        .ZwProtectVirtualMemory    = (void*) 0x0002EA68,
        .ZwReadVirtualMemory       = (void*) 0x0002EE64,
      }
    },
    {
      TEXT("ntkrnlmp 5.2.3790.2438 (srv03_sp1_qfe.050504-1733)"),
      TEXT("EC336E77A94E4FBBBDF9A7006199B12C2"),
      {
        .NtCreateProcess           = (void*) 0x000F80C2,
        .NtCreateProcessEx         = (void*) 0x001133B4,
        .NtCreateSection           = (void*) 0x0013233C,
        .NtCreateUserProcess       = NULL,
        .NtTerminateProcess        = (void*) 0x0011287D,
        .NtQueryInformationFile    = (void*) 0x0012F5E0,
        .NtQueryKey                = (void*) 0x0013F311,
        .NtQueryValueKey           = (void*) 0x0013CB66,
        .NtSetInformationFile      = (void*) 0x0012F8E4,
        .NtSetValueKey             = (void*) 0x0013293F,
        .ObpFreeObject             = (void*) 0x0012AAC5,
        .PspTerminateProcess       = (void*) 0x001A2652,
        .swprintf                  = (void*) 0x0001C615,
        .ZwOpenProcess             = (void*) 0x0003C830,
        .ZwProtectVirtualMemory    = (void*) 0x0003C95C,
        .ZwReadVirtualMemory       = (void*) 0x0003CD58,
      }
    },
    {
      TEXT("ntkrpamp 6.0.5600.16384 (vista_rc1.060829-2230)"),
      TEXT("A60B2B6C061F47FF8BBADF2D2330D1322"),
      {
        .NtCreateProcess           = (void*) 0x002B34B8,
        .NtCreateProcessEx         = (void*) 0x002B3503,
        .NtCreateSection           = (void*) 0x0022F139,
        .NtCreateUserProcess       = (void*) 0x00258A3B,
        .NtTerminateProcess        = (void*) 0x0025B474,
        .NtQueryInformationFile    = (void*) 0x0022F37B,
        .NtQueryKey                = (void*) 0x00242E79,
        .NtQueryValueKey           = (void*) 0x00240C8D,
        .NtSetInformationFile      = (void*) 0x00222B3F,
        .NtSetValueKey             = (void*) 0x001FE85E,
        .ObpFreeObject             = (void*) 0x0020DABE,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x0010C9B2,
        .ZwOpenProcess             = (void*) 0x000432F8,
        .ZwProtectVirtualMemory    = (void*) 0x00043438,
        .ZwReadVirtualMemory       = (void*) 0x00043834,
      }
    },
    {
      TEXT("ntkrnlmp 6.0.5600.16384 (vista_rc1.060829-2230)"),
      TEXT("1A11D2890F724D0986991D2EB57DCDE12"),
      {
        .NtCreateProcess           = (void*) 0x0028D528,
        .NtCreateProcessEx         = (void*) 0x0028D573,
        .NtCreateSection           = (void*) 0x0022375A,
        .NtCreateUserProcess       = (void*) 0x00231FBB,
        .NtTerminateProcess        = (void*) 0x002214BB,
        .NtQueryInformationFile    = (void*) 0x002120EA,
        .NtQueryKey                = (void*) 0x002167B5,
        .NtQueryValueKey           = (void*) 0x002380A6,
        .NtSetInformationFile      = (void*) 0x0021FA23,
        .NtSetValueKey             = (void*) 0x001D2D96,
        .ObpFreeObject             = (void*) 0x001E6C49,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x000101B3,
        .ZwOpenProcess             = (void*) 0x0004C968,
        .ZwProtectVirtualMemory    = (void*) 0x0004CAA8,
        .ZwReadVirtualMemory       = (void*) 0x0004CEA4,
      }
    },
    {
      TEXT("ntkrpamp 6.0.5744.16384 (vista_rtm_edw.061003-1945)"),
      TEXT("6FB5B7D5D7C04735B3DC168622497B2B2"),
      {
        .NtCreateProcess           = (void*) 0x0021228A,
        .NtCreateProcessEx         = (void*) 0x002122D5,
        .NtCreateSection           = (void*) 0x001D763B,
        .NtCreateUserProcess       = (void*) 0x0022244F,
        .NtTerminateProcess        = (void*) 0x0021AF23,
        .NtQueryInformationFile    = (void*) 0x00190C42,
        .NtQueryKey                = (void*) 0x0013952F,
        .NtQueryValueKey           = (void*) 0x0013980B,
        .NtSetInformationFile      = (void*) 0x001914A1,
        .NtSetValueKey             = (void*) 0x0013A03D,
        .ObpFreeObject             = (void*) 0x001F5DBD,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x00075460,
        .ZwOpenProcess             = (void*) 0x0006F9C8,
        .ZwProtectVirtualMemory    = (void*) 0x0006FB08,
        .ZwReadVirtualMemory       = (void*) 0x0006FF04,
      }
    },
    {
      TEXT("ntkrnlmp 6.0.5744.16384 (vista_rtm_edw.061003-1945)"),
      TEXT("6C0BE07BB9F040E6A9B6B6C0B4BC1E0B2"),
      {
        .NtCreateProcess           = (void*) 0x0026BA44,
        .NtCreateProcessEx         = (void*) 0x0026BA8F,
        .NtCreateSection           = (void*) 0x0020347D,
        .NtCreateUserProcess       = (void*) 0x00210E49,
        .NtTerminateProcess        = (void*) 0x001B8B16,
        .NtQueryInformationFile    = (void*) 0x001F20D4,
        .NtQueryKey                = (void*) 0x001F65E8,
        .NtQueryValueKey           = (void*) 0x00216F7C,
        .NtSetInformationFile      = (void*) 0x001FF90F,
        .NtSetValueKey             = (void*) 0x001B2FBE,
        .ObpFreeObject             = (void*) 0x001C6EA9,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x0000E692,
        .ZwOpenProcess             = (void*) 0x00044834,
        .ZwProtectVirtualMemory    = (void*) 0x00044974,
        .ZwReadVirtualMemory       = (void*) 0x00044D70,
      }
    },
    {
      TEXT("ntkrpamp 6.0.6000.16386 (vista_rtm.061101-2205)"),
      TEXT("FD50D285751D4684938604B2CC1B41682"),
      {
        .NtCreateProcess           = (void*) 0x002123B2,
        .NtCreateProcessEx         = (void*) 0x002123FD,
        .NtCreateSection           = (void*) 0x001D7703,
        .NtCreateUserProcess       = (void*) 0x0022256F,
        .NtTerminateProcess        = (void*) 0x0021B043,
        .NtQueryInformationFile    = (void*) 0x00190CF6,
        .NtQueryKey                = (void*) 0x00139557,
        .NtQueryValueKey           = (void*) 0x0013985A,
        .NtSetInformationFile      = (void*) 0x00191555,
        .NtSetValueKey             = (void*) 0x0013A08B,
        .ObpFreeObject             = (void*) 0x001F5EE9,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x00082D36,
        .ZwOpenProcess             = (void*) 0x0007EA5C,
        .ZwProtectVirtualMemory    = (void*) 0x0007EB9C,
        .ZwReadVirtualMemory       = (void*) 0x0007EF98,
      }
    },
    {
      TEXT("ntkrnlmp 6.0.6000.16386 (vista_rtm.061101-2205)"),
      TEXT("8EE03D077FB748338312523DCC42D1692"),
      {
        .NtCreateProcess           = (void*) 0x0026BBD4,
        .NtCreateProcessEx         = (void*) 0x0026BC1F,
        .NtCreateSection           = (void*) 0x002034AD,
        .NtCreateUserProcess       = (void*) 0x00210E79,
        .NtTerminateProcess        = (void*) 0x0020120E,
        .NtQueryInformationFile    = (void*) 0x001F2330,
        .NtQueryKey                = (void*) 0x001F64C8,
        .NtQueryValueKey           = (void*) 0x00216FAC,
        .NtSetInformationFile      = (void*) 0x001FF751,
        .NtSetValueKey             = (void*) 0x001B3086,
        .ObpFreeObject             = (void*) 0x001C6D89,
        .PspTerminateProcess       = NULL,
        .swprintf                  = (void*) 0x0000E694,
        .ZwOpenProcess             = (void*) 0x000446A8,
        .ZwProtectVirtualMemory    = (void*) 0x000447E8,
        .ZwReadVirtualMemory       = (void*) 0x00044BE4,
      }
    },
  } ;


/******************************************************************/
/* Exported function                                              */
/******************************************************************/

NTSTATUS NtUndoc_Init() 
{
  IMGINFO   imgInfo ;

  PBYTE     pKernelBase = NULL ;
  ULONG     nKernelSize = 0 ;
  
  INT       iVersion ;
  INT       iDetectedVersion = -1 ;
  INT       iFunc ;

  SystInfo_GetModuleBase (NULL, (void**)&pKernelBase, &nKernelSize) ;

  TRACE_INFO(TEXT("Kernel base : 0x%08X\n"), pKernelBase) ;
  TRACE_INFO(TEXT("Kernel size : 0x%08X\n"), nKernelSize) ;

  if( ! ImgInfo_GetInfo (&imgInfo, pKernelBase, nKernelSize, FALSE) )
    {
      TRACE_ERROR (TEXT("ImgInfo_GetInfo failed\n")) ;
      return STATUS_UNSUCCESSFUL ;
    }

  TRACE_INFO(TEXT("Image signature = %s\n"), imgInfo.szSymSignature) ;

  for( iVersion=0 ; iVersion<arraysize(g_aOsVersion) ; iVersion++ )
    {
      STRING strSig1, strSig2 ;

      TRACE_INFO (TEXT("Checking %s...\n"), g_aOsVersion[iVersion].szOsVersion) ;

      RtlInitString (&strSig1, g_aOsVersion[iVersion].szSignature) ;
      RtlInitString (&strSig2, imgInfo.szSymSignature) ;

      if( RtlCompareString(&strSig1,&strSig2,TRUE) )
      {
        TRACE_INFO (TEXT("Signature doesn't match\n")) ;
        continue ;
      }

      TRACE_INFO (TEXT("Windows version matches !\n")) ;
      iDetectedVersion = iVersion ;
      break ;
    }

  if( iDetectedVersion<0 )
    {
      TRACE_ERROR(TEXT("Windows version not supported\n")) ;
      return STATUS_UNSUCCESSFUL ;
    }

  TRACE_ALWAYS (TEXT("Detected Windows version : %s\n"), g_aOsVersion[iDetectedVersion].szOsVersion) ;

  for( iFunc=0 ; iFunc<sizeof(ntundoc)/sizeof(void*) ; iFunc++ )
  {
    int nOffset = ((INT_PTR*)&g_aOsVersion[iDetectedVersion].offsets)[iFunc] ;
    ((BYTE**)&ntundoc)[iFunc] = nOffset ? pKernelBase+nOffset : NULL ;
  }

  return STATUS_SUCCESS ;
}
